Windows Analysis Report
PO P24-1100.exe

AV Detection

Source: PO P24-1100.exe

Avira: detected

Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": " *o9H+18Q4%;M "}

Source: PO P24-1100.exe

ReversingLabs: Detection: 34%

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: PO P24-1100.exe

Joe Sandbox ML: detected

Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: /log.tmp
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>[
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: yyyy-MM-dd HH:mm:ss
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ]<br>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Time:
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: MM/dd/yyyy HH:mm:ss
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>User Name:
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>Computer Name:
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>OSFullName:
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>CPU:
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>RAM:
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: IP Address:
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <hr>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: New
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: MM/dd/yyyy HH:mm:ss
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: IP Address:
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: mail.mbarieservicesltd.com
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: saless@mbarieservicesltd.com
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: *o9H+18Q4%;M
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: iinfo@mbarieservicesltd.com
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: false
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: appdata
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: KTvkzEc
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: KTvkzEc.exe
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: KTvkzEc
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Type
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <hr>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <b>[
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ]</b> (
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: )<br>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {BACK}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {ALT+TAB}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {ALT+F4}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {TAB}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {ESC}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {Win}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {CAPSLOCK}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {KEYUP}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {KEYDOWN}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {KEYLEFT}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {KEYRIGHT}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {DEL}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {END}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {HOME}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {Insert}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {NumLock}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {PageDown}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {PageUp}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {ENTER}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F1}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F2}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F3}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F4}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F5}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F6}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F7}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F8}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F9}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F10}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F11}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {F12}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: control
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {CTRL}
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: &amp;
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: &lt;
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: &gt;
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: &quot;
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <br><hr>Copied Text: <br>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <hr>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: logins
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: IE/Edge
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Windows Secure Note
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: 3CCD5499-87A8-4B10-A215-608888DD3B55
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Windows Web Password Credential
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: 154E23D0-C644-4E6F-8CE6-5069272F999F
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Windows Credential Picker Protector
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Web Credentials
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Windows Credentials
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Windows Domain Certificate Credential
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Windows Domain Password Credential
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Windows Extended Credential
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: 00000000-0000-0000-0000-000000000000
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SchemaId
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: pResourceElement
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: pIdentityElement
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: pPackageSid
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: pAuthenticatorElement
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: IE/Edge
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UC Browser
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UCBrowser\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Login Data
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: journal
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: wow_logins
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Safari for Windows
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Common Files\Apple\Apple Application Support\plutil.exe
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Apple Computer\Preferences\keychain.plist
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <array>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <dict>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <string>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </string>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <string>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </string>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <data>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </data>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: -convert xml1 -s -o "
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \fixed_keychain.xml"
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Microsoft\Credentials\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Microsoft\Credentials\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Microsoft\Credentials\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Microsoft\Credentials\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Microsoft\Protect\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: credential
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: QQ Browser
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Tencent\QQBrowser\User Data
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Default\EncryptedStorage
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Profile
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \EncryptedStorage
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: entries
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: category
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: str3
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: str2
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: blob0
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: password_value
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: IncrediMail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: PopPassword
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SmtpPassword
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\IncrediMail\Identities\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Accounts_New
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: PopPassword
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SmtpPassword
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SmtpServer
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: EmailAddress
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Eudora
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\Qualcomm\Eudora\CommandLine\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: current
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Settings
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SavePasswordText
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Settings
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ReturnAddress
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Falkon Browser
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \falkon\profiles\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: profiles.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: startProfile=([A-z0-9\/\.\"]+)
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: profiles.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \browsedata.db
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: autofill
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ClawsMail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Claws-mail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \clawsrc
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \clawsrc
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: passkey0
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: master_passphrase_salt=(.+)
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: master_passphrase_pbkdf2_rounds=(.+)
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \accountrc
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: smtp_server
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: address
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: account
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \passwordstorerc
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: {(.*),(.*)}(.*)
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Flock Browser
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: APPDATA
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Flock\Browser\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: signons3.txt
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: DynDns
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ALLUSERSPROFILE
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Dyn\Updater\config.dyndns
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: username=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: password=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: https://account.dyn.com/
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: t6KzXhCh
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ALLUSERSPROFILE
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Dyn\Updater\daemon.cfg
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: global
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: accounts
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: account.
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: username
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: account.
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Psi/Psi+
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: name
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Psi/Psi+
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: APPDATA
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Psi\profiles
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: APPDATA
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Psi+\profiles
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \accounts.xml
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \accounts.xml
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: OpenVPN
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\OpenVPN-GUI\configs
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\OpenVPN-GUI\configs
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\OpenVPN-GUI\configs\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: username
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: auth-data
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: entropy
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: USERPROFILE
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \OpenVPN\config\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: remote
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: remote
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: NordVPN
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: NordVPN
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: NordVpn.exe*
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: user.config
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: //setting[@name='Username']/value
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: //setting[@name='Password']/value
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: NordVPN
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Private Internet Access
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: %ProgramW6432%
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Private Internet Access\data
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ProgramFiles(x86)
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Private Internet Access\data
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \account.json
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: .*"username":"(.*?)"
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: .*"password":"(.*?)"
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Private Internet Access
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: privateinternetaccess.com
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: FileZilla
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: APPDATA
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \FileZilla\recentservers.xml
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: APPDATA
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \FileZilla\recentservers.xml
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <Server>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <Host>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <Host>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </Host>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <Port>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </Port>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <User>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <User>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </User>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <Pass encoding="base64">
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <Pass encoding="base64">
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </Pass>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <Pass>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <Pass encoding="base64">
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </Pass>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: CoreFTP
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SOFTWARE\FTPWare\COREFTP\Sites
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: User
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Host
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Port
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: hdfzpysvpzimorhk
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: WinSCP
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: HostName
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UserName
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: PublicKeyFile
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: PortNumber
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: [PRIVATE KEY LOCATION: "{0}"]
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: WinSCP
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ABCDEF
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Flash FXP
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: port
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: user
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: pass
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: quick.dat
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Sites.dat
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \FlashFXP\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \FlashFXP\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: yA36zA48dEhfrvghGRg57h5UlDv3
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: FTP Navigator
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SystemDrive
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \FTP Navigator\Ftplist.txt
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Server
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: No Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: User
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SmartFTP
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: APPDATA
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SmartFTP\Client 2.0\Favorites\Quick Connect
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: WS_FTP
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: appdata
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Ipswitch\WS_FTP\Sites\ws_ftp.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: HOST
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: PWD=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: PWD=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: FtpCommander
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SystemDrive
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SystemDrive
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Program Files (x86)\FTP Commander\Ftplist.txt
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SystemDrive
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \cftp\Ftplist.txt
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ;Password=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ;User=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ;Server=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ;Port=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ;Port=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ;Password=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ;User=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ;Anonymous=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: FTPGetter
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \FTPGetter\servers.xml
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <server>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <server_ip>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <server_ip>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </server_ip>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <server_port>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </server_port>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <server_user_name>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <server_user_name>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </server_user_name>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <server_user_password>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: <server_user_password>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: </server_user_password>
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: FTPGetter
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: The Bat!
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: appdata
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \The Bat!
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Account.CFN
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Account.CFN
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: +-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Becky!
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: HKEY_CURRENT_USER\Software\RimArts\B2\Settings
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: DataDir
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Folder.lst
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Mailbox.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Account
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: PassWd
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Account
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SMTPServer
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Account
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: MailAddress
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Becky!
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Outlook
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Email
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: IMAP Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: POP3 Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: HTTP Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SMTP Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Email
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Email
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Email
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: IMAP Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: POP3 Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: HTTP Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SMTP Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Server
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Windows Mail App
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: COMPlus_legacyCorruptedStateExceptionsPolicy
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\Microsoft\ActiveSync\Partners
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Email
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Server
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SchemaId
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: pResourceElement
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: pIdentityElement
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: pPackageSid
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: pAuthenticatorElement
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: syncpassword
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: mailoutgoing
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: FoxMail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Executable
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: FoxmailPath
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Storage\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Storage\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \mail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \mail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \VirtualStore\Program Files\Foxmail\mail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \VirtualStore\Program Files\Foxmail\mail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Accounts\Account.rec0
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Accounts\Account.rec0
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Account.stg
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Account.stg
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: POP3Host
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SMTPHost
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: IncomingServer
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Account
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: MailAddress
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: POP3Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Opera Mail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Opera Mail\Opera Mail\wand.dat
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Opera Mail\Opera Mail\wand.dat
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: opera:
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz1234567890_-.~!@#$%^&*()[{]}\|';:,<>/?+=
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: PocoMail
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: appdata
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Pocomail\accounts.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Email
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: POPPass
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SMTPPass
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SMTP
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: eM Client
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: eM Client\accounts.dat
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: eM Client
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Accounts
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: "Username":"
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: "Secret":"
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: 72905C47-F4FD-4CF7-A489-4E8121A155BD
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: "ProviderName":"
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: o6806642kbM7c5
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Mailbird
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SenderIdentities
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Accounts
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \Mailbird\Store\Store.db
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Server_Host
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Accounts
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Email
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Username
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: EncryptedPassword
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Mailbird
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: RealVNC 4.x
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SOFTWARE\Wow6432Node\RealVNC\WinVNC4
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: RealVNC 3.x
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SOFTWARE\RealVNC\vncserver
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: RealVNC 4.x
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: SOFTWARE\RealVNC\WinVNC4
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: RealVNC 3.x
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\ORL\WinVNC3
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: TightVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\TightVNC\Server
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: TightVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\TightVNC\Server
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: PasswordViewOnly
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: TightVNC ControlPassword
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\TightVNC\Server
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ControlPassword
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: TigerVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\TigerVNC\Server
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Password
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UltraVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ProgramFiles(x86)
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: passwd
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UltraVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ProgramFiles(x86)
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: passwd2
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UltraVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ProgramFiles
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: passwd
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UltraVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ProgramFiles
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: passwd2
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UltraVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ProgramFiles
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: passwd
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UltraVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ProgramFiles
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: passwd2
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UltraVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ProgramFiles(x86)
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: passwd
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: UltraVNC
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: ProgramFiles(x86)
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: passwd2
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: JDownloader 2.0
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: JDownloader 2.0\cfg
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: org.jdownloader.settings.AccountSettings.accounts.ejs
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: JDownloader 2.0\cfg
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: jd.controlling.authentication.AuthenticationControllerSettings.list.ejs
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Paltalk
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: Software\A.V.M.\Paltalk NG\common_settings\core\users\creds\
Source: 0.2.PO P24-1100.exe.3ee1560.3.unpack	String decryptor: nickname

Compliance

Source: PO P24-1100.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO P24-1100.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: xlCv.pdbSHA256 source: PO P24-1100.exe
Source:	Binary string: xlCv.pdb source: PO P24-1100.exe

Networking

Source: unknown

DNS traffic detected: query: mail.mbarieservicesltd.com replaycode: Server failure (2)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.mbarieservicesltd.com

Source: PO P24-1100.exe, 00000000.00000002.1731687325.0000000002D85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO P24-1100.exe, 00000000.00000002.1737153746.00000000071B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

System Summary

Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_00E4DF64		0_2_00E4DF64
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_02BE7C08		0_2_02BE7C08
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_02BEA0B1		0_2_02BEA0B1
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_02BE001B		0_2_02BE001B
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_02BE0040		0_2_02BE0040
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_051E9DE8		0_2_051E9DE8
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_051EACB0		0_2_051EACB0
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_051E646C		0_2_051E646C
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_051E8B5A		0_2_051E8B5A
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_0AA60448		0_2_0AA60448
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_0AA61AF8		0_2_0AA61AF8
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_00B14140		3_2_00B14140
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_00B14D58		3_2_00B14D58
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_00B14488		3_2_00B14488
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_062037F8		3_2_062037F8
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_062019A0		3_2_062019A0
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_0628C220		3_2_0628C220
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_06289C23		3_2_06289C23
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_06280040		3_2_06280040
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_062894A0		3_2_062894A0
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_0628A8F8		3_2_0628A8F8
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_062871D0		3_2_062871D0
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_062839E8		3_2_062839E8
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_062839D8		3_2_062839D8
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_06280028		3_2_06280028

Source: PO P24-1100.exe, 00000000.00000002.1731687325.0000000002D85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs PO P24-1100.exe
Source: PO P24-1100.exe, 00000000.00000002.1735468081.0000000005410000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs PO P24-1100.exe
Source: PO P24-1100.exe, 00000000.00000002.1738194356.00000000078E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs PO P24-1100.exe
Source: PO P24-1100.exe, 00000000.00000000.1696283657.000000000088E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexlCv.exeB vs PO P24-1100.exe
Source: PO P24-1100.exe, 00000000.00000002.1732307986.0000000003D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs PO P24-1100.exe
Source: PO P24-1100.exe, 00000000.00000002.1732307986.0000000003D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs PO P24-1100.exe
Source: PO P24-1100.exe, 00000000.00000002.1731687325.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs PO P24-1100.exe
Source: PO P24-1100.exe, 00000000.00000002.1725265698.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO P24-1100.exe
Source: PO P24-1100.exe, 00000003.00000002.2945839858.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO P24-1100.exe
Source: PO P24-1100.exe, 00000003.00000002.2944805908.000000000042C000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs PO P24-1100.exe
Source: PO P24-1100.exe, 00000003.00000002.2944994303.0000000000939000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO P24-1100.exe
Source: PO P24-1100.exe	Binary or memory string: OriginalFilenamexlCv.exeB vs PO P24-1100.exe

Source: PO P24-1100.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO P24-1100.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PO P24-1100.exe.3f0a580.1.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO P24-1100.exe.3f0a580.1.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PO P24-1100.exe.3f0a580.1.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO P24-1100.exe.3f0a580.1.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO P24-1100.exe.3f0a580.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO P24-1100.exe.3f0a580.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO P24-1100.exe.3f0a580.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO P24-1100.exe.3f0a580.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, GfgLj0u1p422pIcK9p.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, ddSoI96RcnCUBdaTbJ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, ddSoI96RcnCUBdaTbJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, ddSoI96RcnCUBdaTbJ.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, GfgLj0u1p422pIcK9p.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, ddSoI96RcnCUBdaTbJ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, ddSoI96RcnCUBdaTbJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, ddSoI96RcnCUBdaTbJ.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/6@4/0

Source: C:\Users\user\Desktop\PO P24-1100.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO P24-1100.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2172:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1u0lg1i.cy2.ps1

Jump to behavior

Source: PO P24-1100.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO P24-1100.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\PO P24-1100.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO P24-1100.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO P24-1100.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO P24-1100.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\PO P24-1100.exe "C:\Users\user\Desktop\PO P24-1100.exe"
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO P24-1100.exe"
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process created: C:\Users\user\Desktop\PO P24-1100.exe "C:\Users\user\Desktop\PO P24-1100.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO P24-1100.exe"			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process created: C:\Users\user\Desktop\PO P24-1100.exe "C:\Users\user\Desktop\PO P24-1100.exe"			Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: dwrite.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: windowscodecs.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: vaultcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: dhcpcsvc6.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: dhcpcsvc.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Section loaded: rasadhlp.dll			Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PO P24-1100.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PO P24-1100.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO P24-1100.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PO P24-1100.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: xlCv.pdbSHA256 source: PO P24-1100.exe
Source:	Binary string: xlCv.pdb source: PO P24-1100.exe

Data Obfuscation

Source: PO P24-1100.exe, MainForm.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, ddSoI96RcnCUBdaTbJ.cs	.Net Code: jiECT8e0ky System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, ddSoI96RcnCUBdaTbJ.cs	.Net Code: jiECT8e0ky System.Reflection.Assembly.Load(byte[])

Source: PO P24-1100.exe

Static PE information: 0x860193C9 [Sat Mar 30 09:58:33 2041 UTC]

Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 0_2_051E70D2 push ecx; ret		0_2_051E710C
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_00B113A7 pushfd ; ret		3_2_00B11338
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_06286636 pushfd ; ret		3_2_06286639
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_0628711C pushfd ; ret		3_2_0628713B
Source: C:\Users\user\Desktop\PO P24-1100.exe	Code function: 3_2_062865D0 pushfd ; ret		3_2_062865D2

Source: PO P24-1100.exe

Static PE information: section name: .text entropy: 7.978390411078157

Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, rSiaS8zbHOupgjKMqr.cs	High entropy of concatenated method names: 'vWfirehODm', 'jA6iufCxLZ', 'zJki33yTgw', 'wAKidR0oHs', 'keUip2IID6', 'SPKiHhTapv', 'WtWitOJvvG', 'U9XiD6SXV6', 'YO9if7u0l8', 'T8riMNW7XA'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, CwLFuwCRtlry8Ihr9x.cs	High entropy of concatenated method names: 'qHdmKfgLj0', 'Tp4m622pIc', 'SRpmlgEOnf', 'hr7mVhGKTZ', 'r7EmoND5Im', 'KqSmvwIUNV', 'bCaAa0NvQOCbua33a6', 'q7ZvORV0IvkwtHYn0w', 'xD7mm2yeT4', 'IeHmEbYj5L'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, I8k69bBhcJk8XM1Loc.cs	High entropy of concatenated method names: 'ToString', 'vwtvImMaVm', 'E3kvpiNKfZ', 'NEKvxB3CcU', 'rjcvHH88mO', 'yLkvtaHX13', 'j0pvc71MSs', 'QcevWfBnEY', 'SGDvkscNNw', 'nh8vOtYTR9'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, eZQMwHWHjPXCvp9K5E.cs	High entropy of concatenated method names: 'lNYK4irwqR', 'RSUK5ioZ1J', 'bkZKbby2uO', 'DA7bwYGjjP', 'u5ZbzP5VOq', 'Xp8KnZFsVF', 'tKTKmTeINj', 'uZpKapVa5o', 'cCkKELp561', 'zqEKCrcPkf'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, AGRIdmacD34X8JqfqL.cs	High entropy of concatenated method names: 'XSPTt801l', 'cViFLpj7u', 'geerPxDsE', 'ltbPT9du2', 'iyX3397Ha', 'O5ZAuTYoY', 'd1SqBwAZ3Eg3GAVYBM', 'Ych46CBgaTsZOBKXiJ', 'kCf9ZyJOx', 'H0disVCcH'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, bf22oHyxkktqlUGEyJ.cs	High entropy of concatenated method names: 'NnfUoZbLFK', 'aPvULvT26m', 'n9KUUrWEmi', 'rJGUZwZ56h', 'MSLUhlMgN1', 'CgmUD14tyD', 'Dispose', 'UNQ94uZwYB', 'tbW9qT1SRh', 'HaM95u6ftn'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, GfgLj0u1p422pIcK9p.cs	High entropy of concatenated method names: 'S2pqs9Y6rc', 'ysJqYpXFU3', 'n9AqBLPmpN', 'isoq1NWyL6', 'AIJqjUBVUS', 'MhQqG25BBH', 'mWuqyDR912', 'CrdqQaNO6Q', 'OSLqNTcbKu', 'qvLqwi0W32'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, jHGFeomCxQWPJ8T99Yt.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ser8UXtkPA', 'mAY8ieeN0o', 'Xd38Z3FFOg', 'd3G887OPJe', 'KPP8hKGoQJ', 'c4n80Wu3A2', 'Ol98DfflVN'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, qoISy3O3y1fmTU4uUb.cs	High entropy of concatenated method names: 'd0hKfUWQr3', 'wJ8KM8BZSk', 'eF9KTDIPiD', 'R96KFScDH9', 'l1QKef2qwu', 'qjXKrTJJme', 'JVXKPAYcKv', 'XguKueBCOe', 'EudK33r25X', 'SR3KAmyjq1'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, NC33vps37PRKumb6WG.cs	High entropy of concatenated method names: 'dO5ogxFJbk', 'wCGoSo3ViP', 'YqMos2STp7', 'Q88oYG1rCJ', 'wnYopfSv6c', 'eIwoxmSXlE', 'LkLoHwVUmY', 'bxuotJCvRk', 'Bsgoc8cjge', 'Le3oWse54f'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, giDPdkwbniocP5qfiG.cs	High entropy of concatenated method names: 'v7Vi5g9UQt', 'vfTiXb99OK', 'NZvibBcUf4', 'jBriKexCxl', 'n6kiU6qV9f', 'Wc9i6BkPYD', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, PidoDDqUDqWxXxx5PB.cs	High entropy of concatenated method names: 'Dispose', 'MtqmNlUGEy', 'NphapTLgBW', 'DYm0Tfo9uX', 'Q6emwUCR1k', 'eOemz6j3GH', 'ProcessDialogKey', 'iJLanTT9e5', 'Q1BamdKikT', 'sQYaaqiDPd'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, Lq1kpNmmQkyvFgE8dID.cs	High entropy of concatenated method names: 'g1PiwLUkgU', 'sPoizEdRUa', 'pOKZnYiKEs', 'AGxZm41Ucl', 'JMPZaMoGUD', 'g7nZE0hjOx', 'qcLZCAyfHS', 'i7EZ24cjrQ', 'CqnZ4NNYqd', 'ChsZqtSoFU'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, aOhgWcmndciGiypg5s2.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qVoiI2ewNQ', 'SOTiSoSMdm', 's5LiJd5yn6', 'mRbisLqsIx', 'Q35iYAkRbq', 'DOjiBVIwVn', 'iERi1ExPeA'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, K93061JJd1VbooLmkd.cs	High entropy of concatenated method names: 'sCuRul3W2D', 'lccR3p91Gk', 'pHFRdvTPOm', 'iCqRpdYvfP', 'CDaRHpmMb8', 'qgwRtMZSvt', 'gRjRWf7JSH', 'xhSRkuGsMx', 'rrgRgSXWqB', 'n8URIcRCFZ'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, EfUtvJ13YEuCM8k0GW.cs	High entropy of concatenated method names: 'RRuLl7b829', 'CWILVrYmO5', 'ToString', 'HFWL477ofY', 'HG3LqhcIjU', 'UlEL5IwjHo', 'QQqLXPnMLd', 'MBQLb8dGhp', 'aAZLKV8kHd', 'cSiL6i9KMk'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, qTT9e5Ns1BdKikTiQY.cs	High entropy of concatenated method names: 'eyQUdVlWEG', 'iDhUpa5KFv', 'hgZUxCeBEg', 'KrlUHfanb2', 'PDsUtAgP0S', 'umgUcLYlgU', 'yjlUWLyZbH', 'QE1UkTu5ZK', 'wFVUOE9Clq', 'hEfUg9yFPU'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, ddSoI96RcnCUBdaTbJ.cs	High entropy of concatenated method names: 'XEcE2QuNpg', 'kIFE4SJ4Bi', 'LNJEqKJnht', 'ukEE5woaGL', 'qdZEX7wiAo', 'OABEb7GMyW', 'yGbEK6mr5B', 'WqFE6Qr3ee', 'RKmE7c2McU', 'LZiEl0OqGj'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, y9BhMB3RpgEOnf5r7h.cs	High entropy of concatenated method names: 'o0Z5FGeXan', 'hOb5rdIYCn', 'V345uHKepg', 'vgJ53nIh9b', 'Aho5o4yBBk', 'PmU5vWFHCw', 'OX75L3WVMM', 'XOy59F17ph', 'VBq5Ugo8rG', 'PgN5i7IPKt'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, hImcqSdwIUNV0IcXpy.cs	High entropy of concatenated method names: 'qM1b2sJC8x', 'GJqbqj0m7D', 'fODbXEKKbZ', 'nSsbKBUYtQ', 'IbAb6Bs7mF', 'z2LXjfppYp', 'DLxXGe3I1O', 'OxUXySQqP7', 'z7HXQOk4Ec', 'o7SXNJvPIs'
Source: 0.2.PO P24-1100.exe.78e0000.5.raw.unpack, k4P9W7GiW52QidbN6E.cs	High entropy of concatenated method names: 'IpILQ5NdoK', 'Rl7LwtT7BR', 'O0A9nKJJgb', 'LEJ9mK8eyc', 'RQ1LIygdRl', 'NsjLSmJHB4', 'KecLJP33hW', 'FEfLsa5MNY', 'p7ILYKLEM6', 'N3xLBMn5Vs'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, rSiaS8zbHOupgjKMqr.cs	High entropy of concatenated method names: 'vWfirehODm', 'jA6iufCxLZ', 'zJki33yTgw', 'wAKidR0oHs', 'keUip2IID6', 'SPKiHhTapv', 'WtWitOJvvG', 'U9XiD6SXV6', 'YO9if7u0l8', 'T8riMNW7XA'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, CwLFuwCRtlry8Ihr9x.cs	High entropy of concatenated method names: 'qHdmKfgLj0', 'Tp4m622pIc', 'SRpmlgEOnf', 'hr7mVhGKTZ', 'r7EmoND5Im', 'KqSmvwIUNV', 'bCaAa0NvQOCbua33a6', 'q7ZvORV0IvkwtHYn0w', 'xD7mm2yeT4', 'IeHmEbYj5L'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, I8k69bBhcJk8XM1Loc.cs	High entropy of concatenated method names: 'ToString', 'vwtvImMaVm', 'E3kvpiNKfZ', 'NEKvxB3CcU', 'rjcvHH88mO', 'yLkvtaHX13', 'j0pvc71MSs', 'QcevWfBnEY', 'SGDvkscNNw', 'nh8vOtYTR9'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, eZQMwHWHjPXCvp9K5E.cs	High entropy of concatenated method names: 'lNYK4irwqR', 'RSUK5ioZ1J', 'bkZKbby2uO', 'DA7bwYGjjP', 'u5ZbzP5VOq', 'Xp8KnZFsVF', 'tKTKmTeINj', 'uZpKapVa5o', 'cCkKELp561', 'zqEKCrcPkf'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, AGRIdmacD34X8JqfqL.cs	High entropy of concatenated method names: 'XSPTt801l', 'cViFLpj7u', 'geerPxDsE', 'ltbPT9du2', 'iyX3397Ha', 'O5ZAuTYoY', 'd1SqBwAZ3Eg3GAVYBM', 'Ych46CBgaTsZOBKXiJ', 'kCf9ZyJOx', 'H0disVCcH'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, bf22oHyxkktqlUGEyJ.cs	High entropy of concatenated method names: 'NnfUoZbLFK', 'aPvULvT26m', 'n9KUUrWEmi', 'rJGUZwZ56h', 'MSLUhlMgN1', 'CgmUD14tyD', 'Dispose', 'UNQ94uZwYB', 'tbW9qT1SRh', 'HaM95u6ftn'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, GfgLj0u1p422pIcK9p.cs	High entropy of concatenated method names: 'S2pqs9Y6rc', 'ysJqYpXFU3', 'n9AqBLPmpN', 'isoq1NWyL6', 'AIJqjUBVUS', 'MhQqG25BBH', 'mWuqyDR912', 'CrdqQaNO6Q', 'OSLqNTcbKu', 'qvLqwi0W32'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, jHGFeomCxQWPJ8T99Yt.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ser8UXtkPA', 'mAY8ieeN0o', 'Xd38Z3FFOg', 'd3G887OPJe', 'KPP8hKGoQJ', 'c4n80Wu3A2', 'Ol98DfflVN'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, qoISy3O3y1fmTU4uUb.cs	High entropy of concatenated method names: 'd0hKfUWQr3', 'wJ8KM8BZSk', 'eF9KTDIPiD', 'R96KFScDH9', 'l1QKef2qwu', 'qjXKrTJJme', 'JVXKPAYcKv', 'XguKueBCOe', 'EudK33r25X', 'SR3KAmyjq1'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, NC33vps37PRKumb6WG.cs	High entropy of concatenated method names: 'dO5ogxFJbk', 'wCGoSo3ViP', 'YqMos2STp7', 'Q88oYG1rCJ', 'wnYopfSv6c', 'eIwoxmSXlE', 'LkLoHwVUmY', 'bxuotJCvRk', 'Bsgoc8cjge', 'Le3oWse54f'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, giDPdkwbniocP5qfiG.cs	High entropy of concatenated method names: 'v7Vi5g9UQt', 'vfTiXb99OK', 'NZvibBcUf4', 'jBriKexCxl', 'n6kiU6qV9f', 'Wc9i6BkPYD', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, PidoDDqUDqWxXxx5PB.cs	High entropy of concatenated method names: 'Dispose', 'MtqmNlUGEy', 'NphapTLgBW', 'DYm0Tfo9uX', 'Q6emwUCR1k', 'eOemz6j3GH', 'ProcessDialogKey', 'iJLanTT9e5', 'Q1BamdKikT', 'sQYaaqiDPd'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, Lq1kpNmmQkyvFgE8dID.cs	High entropy of concatenated method names: 'g1PiwLUkgU', 'sPoizEdRUa', 'pOKZnYiKEs', 'AGxZm41Ucl', 'JMPZaMoGUD', 'g7nZE0hjOx', 'qcLZCAyfHS', 'i7EZ24cjrQ', 'CqnZ4NNYqd', 'ChsZqtSoFU'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, aOhgWcmndciGiypg5s2.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qVoiI2ewNQ', 'SOTiSoSMdm', 's5LiJd5yn6', 'mRbisLqsIx', 'Q35iYAkRbq', 'DOjiBVIwVn', 'iERi1ExPeA'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, K93061JJd1VbooLmkd.cs	High entropy of concatenated method names: 'sCuRul3W2D', 'lccR3p91Gk', 'pHFRdvTPOm', 'iCqRpdYvfP', 'CDaRHpmMb8', 'qgwRtMZSvt', 'gRjRWf7JSH', 'xhSRkuGsMx', 'rrgRgSXWqB', 'n8URIcRCFZ'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, EfUtvJ13YEuCM8k0GW.cs	High entropy of concatenated method names: 'RRuLl7b829', 'CWILVrYmO5', 'ToString', 'HFWL477ofY', 'HG3LqhcIjU', 'UlEL5IwjHo', 'QQqLXPnMLd', 'MBQLb8dGhp', 'aAZLKV8kHd', 'cSiL6i9KMk'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, qTT9e5Ns1BdKikTiQY.cs	High entropy of concatenated method names: 'eyQUdVlWEG', 'iDhUpa5KFv', 'hgZUxCeBEg', 'KrlUHfanb2', 'PDsUtAgP0S', 'umgUcLYlgU', 'yjlUWLyZbH', 'QE1UkTu5ZK', 'wFVUOE9Clq', 'hEfUg9yFPU'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, ddSoI96RcnCUBdaTbJ.cs	High entropy of concatenated method names: 'XEcE2QuNpg', 'kIFE4SJ4Bi', 'LNJEqKJnht', 'ukEE5woaGL', 'qdZEX7wiAo', 'OABEb7GMyW', 'yGbEK6mr5B', 'WqFE6Qr3ee', 'RKmE7c2McU', 'LZiEl0OqGj'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, y9BhMB3RpgEOnf5r7h.cs	High entropy of concatenated method names: 'o0Z5FGeXan', 'hOb5rdIYCn', 'V345uHKepg', 'vgJ53nIh9b', 'Aho5o4yBBk', 'PmU5vWFHCw', 'OX75L3WVMM', 'XOy59F17ph', 'VBq5Ugo8rG', 'PgN5i7IPKt'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, hImcqSdwIUNV0IcXpy.cs	High entropy of concatenated method names: 'qM1b2sJC8x', 'GJqbqj0m7D', 'fODbXEKKbZ', 'nSsbKBUYtQ', 'IbAb6Bs7mF', 'z2LXjfppYp', 'DLxXGe3I1O', 'OxUXySQqP7', 'z7HXQOk4Ec', 'o7SXNJvPIs'
Source: 0.2.PO P24-1100.exe.3f4eb80.2.raw.unpack, k4P9W7GiW52QidbN6E.cs	High entropy of concatenated method names: 'IpILQ5NdoK', 'Rl7LwtT7BR', 'O0A9nKJJgb', 'LEJ9mK8eyc', 'RQ1LIygdRl', 'NsjLSmJHB4', 'KecLJP33hW', 'FEfLsa5MNY', 'p7ILYKLEM6', 'N3xLBMn5Vs'

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: Yara match

File source: Process Memory Space: PO P24-1100.exe PID: 6768, type: MEMORYSTR

Source: C:\Users\user\Desktop\PO P24-1100.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\PO P24-1100.exe	Memory allocated: E40000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Memory allocated: 2D10000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Memory allocated: 1030000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Memory allocated: 7EE0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Memory allocated: 8EE0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Memory allocated: 90A0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Memory allocated: A0A0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Memory allocated: B10000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Memory allocated: 2970000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Memory allocated: 26D0000 memory reserve | memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6627			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3106			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Window / User API: threadDelayed 2644			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Window / User API: threadDelayed 7204			Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6844	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4960	Thread sleep time: -11068046444225724s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 1460	Thread sleep count: 2644 > 30			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 1460	Thread sleep count: 7204 > 30			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -24903104499507879s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -100000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -99872s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -99763s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -99617s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -99503s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -99248s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -99134s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -99030s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -98922s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -98812s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -98703s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -98594s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -98484s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -98375s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -98265s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -98156s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -98047s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -97937s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -97828s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -97719s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -97594s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -97484s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -97375s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -97265s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -97156s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -97047s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -96937s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -96828s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -96718s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -96609s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -96500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -96390s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -96281s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -96172s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -96047s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -95937s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -95828s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -95719s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -95594s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -95484s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -95375s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -95266s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -95156s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -95047s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -94938s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -94813s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -94688s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -94578s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe TID: 6532	Thread sleep time: -94469s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PO P24-1100.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO P24-1100.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 100000			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 99872			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 99763			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 99617			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 99503			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 99248			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 99134			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 99030			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 98922			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 98812			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 98703			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 98594			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 98484			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 98375			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 98265			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 98156			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 98047			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 97937			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 97828			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 97719			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 97594			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 97484			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 97375			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 97265			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 97156			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 97047			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 96937			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 96828			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 96718			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 96609			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 96500			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 96390			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 96281			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 96172			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 96047			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 95937			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 95828			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 95719			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 95594			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 95484			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 95375			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 95266			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 95156			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 95047			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 94938			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 94813			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 94688			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 94578			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Thread delayed: delay time: 94469			Jump to behavior

Source: PO P24-1100.exe, 00000000.00000002.1725328271.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: PO P24-1100.exe, 00000000.00000002.1725328271.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8G
Source: PO P24-1100.exe, 00000003.00000002.2950207081.0000000005D60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\PO P24-1100.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO P24-1100.exe"
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO P24-1100.exe"			Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO P24-1100.exe"			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Process created: C:\Users\user\Desktop\PO P24-1100.exe "C:\Users\user\Desktop\PO P24-1100.exe"			Jump to behavior

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Users\user\Desktop\PO P24-1100.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Users\user\Desktop\PO P24-1100.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Source: Yara match	File source: 00000003.00000002.2947100789.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO P24-1100.exe PID: 2596, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 0.2.PO P24-1100.exe.3f0a580.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PO P24-1100.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO P24-1100.exe.3ee1560.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO P24-1100.exe.3f0a580.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO P24-1100.exe.3ee1560.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2944805908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1732307986.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PO P24-1100.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini			Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Source: C:\Users\user\Desktop\PO P24-1100.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\Desktop\PO P24-1100.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior

Source: Yara match	File source: 00000003.00000002.2947100789.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO P24-1100.exe PID: 2596, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 00000003.00000002.2947100789.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO P24-1100.exe PID: 2596, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 0.2.PO P24-1100.exe.3f0a580.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PO P24-1100.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO P24-1100.exe.3ee1560.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO P24-1100.exe.3f0a580.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO P24-1100.exe.3ee1560.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2944805908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1732307986.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY