Edit tour

Windows Analysis Report
PO1234.001.exe

Overview

General Information

Sample name:	PO1234.001.exe
Analysis ID:	1596508
MD5:	435e17a63de9770c43659f6a6120ef5e
SHA1:	1bdce2820788f662108d4b6a2555f6dceb715a3d
SHA256:	36c4b76918ad0cc2990097d29fe693eb3333709e20b33b97ab12d6ccbaf3e4bc
Tags:	001exeMassLoggerQuotationuser-cocaman
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PO1234.001.exe (PID: 6636 cmdline: "C:\Users\user\Desktop\PO1234.001.exe" MD5: 435E17A63DE9770C43659F6A6120EF5E)

RegAsm.exe (PID: 796 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "carlos@instalacionestasende.com", "Password": "VzX79@6v", "Server": "webmail.instalacionestasende.com"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xffa5:$a1: get_encryptedPassword 0x102e1:$a2: get_encryptedUsername 0xfd32:$a3: get_timePasswordChanged 0xfe53:$a4: get_passwordField 0xffbb:$a5: set_encryptedPassword 0x1198b:$a7: get_logins 0x1163c:$a8: GetOutlookPasswords 0x1141a:$a9: StartKeylogger 0x118db:$a10: KeyLoggerEventArgs 0x11477:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb99b5:$a1: get_encryptedPassword 0xd1be5:$a1: get_encryptedPassword 0xe9c05:$a1: get_encryptedPassword 0xb9cf1:$a2: get_encryptedUsername 0xd1f21:$a2: get_encryptedUsername 0xe9f41:$a2: get_encryptedUsername 0xb9742:$a3: get_timePasswordChanged 0xd1972:$a3: get_timePasswordChanged 0xe9992:$a3: get_timePasswordChanged 0xb9863:$a4: get_passwordField 0xd1a93:$a4: get_passwordField 0xe9ab3:$a4: get_passwordField 0xb99cb:$a5: set_encryptedPassword 0xd1bfb:$a5: set_encryptedPassword 0xe9c1b:$a5: set_encryptedPassword 0xbb39b:$a7: get_logins 0xd35cb:$a7: get_logins 0xeb5eb:$a7: get_logins 0xbb04c:$a8: GetOutlookPasswords 0xd327c:$a8: GetOutlookPasswords 0xeb29c:$a8: GetOutlookPasswords
00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: PO1234.001.exe PID: 6636	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: PO1234.001.exe PID: 6636	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO1234.001.exe PID: 6636	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO1234.001.exe PID: 6636	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: PO1234.001.exe PID: 6636	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x62ef0:$a1: get_encryptedPassword 0x6319b:$a2: get_encryptedUsername 0x62c9e:$a3: get_timePasswordChanged 0x62db2:$a4: get_passwordField 0x62f06:$a5: set_encryptedPassword 0x643aa:$a7: get_logins 0x640d8:$a8: GetOutlookPasswords 0x63f0c:$a9: StartKeylogger 0x6430f:$a10: KeyLoggerEventArgs 0x63f69:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegAsm.exe PID: 796	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 796	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 796	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xfea2:$a1: get_encryptedPassword 0x101cf:$a2: get_encryptedUsername 0xfc43:$a3: get_timePasswordChanged 0xfd64:$a4: get_passwordField 0xfeb8:$a5: set_encryptedPassword 0x1182a:$a7: get_logins 0x114db:$a8: GetOutlookPasswords 0x112b9:$a9: StartKeylogger 0x1177a:$a10: KeyLoggerEventArgs 0x11316:$a11: KeyLoggerEventArgsEventHandler
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.PO1234.001.exe.43eaa40.2.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.PO1234.001.exe.43eaa40.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO1234.001.exe.43eaa40.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.PO1234.001.exe.43eaa40.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xe3a5:$a1: get_encryptedPassword 0xe6e1:$a2: get_encryptedUsername 0xe132:$a3: get_timePasswordChanged 0xe253:$a4: get_passwordField 0xe3bb:$a5: set_encryptedPassword 0xfd8b:$a7: get_logins 0xfa3c:$a8: GetOutlookPasswords 0xf81a:$a9: StartKeylogger 0xfcdb:$a10: KeyLoggerEventArgs 0xf877:$a11: KeyLoggerEventArgsEventHandler
0.2.PO1234.001.exe.43eaa40.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1361d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x12b1b:$a3: \Google\Chrome\User Data\Default\Login Data 0x12e29:$a4: \Orbitum\User Data\Default\Login Data 0x13c21:$a5: \Kometa\User Data\Default\Login Data
0.2.PO1234.001.exe.43d2810.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.PO1234.001.exe.43d2810.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO1234.001.exe.43d2810.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.PO1234.001.exe.43d2810.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xe3a5:$a1: get_encryptedPassword 0xe6e1:$a2: get_encryptedUsername 0xe132:$a3: get_timePasswordChanged 0xe253:$a4: get_passwordField 0xe3bb:$a5: set_encryptedPassword 0xfd8b:$a7: get_logins 0xfa3c:$a8: GetOutlookPasswords 0xf81a:$a9: StartKeylogger 0xfcdb:$a10: KeyLoggerEventArgs 0xf877:$a11: KeyLoggerEventArgsEventHandler
0.2.PO1234.001.exe.43d2810.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1361d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x12b1b:$a3: \Google\Chrome\User Data\Default\Login Data 0x12e29:$a4: \Orbitum\User Data\Default\Login Data 0x13c21:$a5: \Kometa\User Data\Default\Login Data
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.RegAsm.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x101a5:$a1: get_encryptedPassword 0x104e1:$a2: get_encryptedUsername 0xff32:$a3: get_timePasswordChanged 0x10053:$a4: get_passwordField 0x101bb:$a5: set_encryptedPassword 0x11b8b:$a7: get_logins 0x1183c:$a8: GetOutlookPasswords 0x1161a:$a9: StartKeylogger 0x11adb:$a10: KeyLoggerEventArgs 0x11677:$a11: KeyLoggerEventArgsEventHandler
1.2.RegAsm.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1541d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1491b:$a3: \Google\Chrome\User Data\Default\Login Data 0x14c29:$a4: \Orbitum\User Data\Default\Login Data 0x15a21:$a5: \Kometa\User Data\Default\Login Data
0.2.PO1234.001.exe.43d2810.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.PO1234.001.exe.43d2810.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO1234.001.exe.43d2810.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.PO1234.001.exe.43d2810.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x101a5:$a1: get_encryptedPassword 0x283d5:$a1: get_encryptedPassword 0x403f5:$a1: get_encryptedPassword 0x104e1:$a2: get_encryptedUsername 0x28711:$a2: get_encryptedUsername 0x40731:$a2: get_encryptedUsername 0xff32:$a3: get_timePasswordChanged 0x28162:$a3: get_timePasswordChanged 0x40182:$a3: get_timePasswordChanged 0x10053:$a4: get_passwordField 0x28283:$a4: get_passwordField 0x402a3:$a4: get_passwordField 0x101bb:$a5: set_encryptedPassword 0x283eb:$a5: set_encryptedPassword 0x4040b:$a5: set_encryptedPassword 0x11b8b:$a7: get_logins 0x29dbb:$a7: get_logins 0x41ddb:$a7: get_logins 0x1183c:$a8: GetOutlookPasswords 0x29a6c:$a8: GetOutlookPasswords 0x41a8c:$a8: GetOutlookPasswords
0.2.PO1234.001.exe.43d2810.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1541d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2d64d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x4566d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1491b:$a3: \Google\Chrome\User Data\Default\Login Data 0x2cb4b:$a3: \Google\Chrome\User Data\Default\Login Data 0x44b6b:$a3: \Google\Chrome\User Data\Default\Login Data 0x14c29:$a4: \Orbitum\User Data\Default\Login Data 0x2ce59:$a4: \Orbitum\User Data\Default\Login Data 0x44e79:$a4: \Orbitum\User Data\Default\Login Data 0x15a21:$a5: \Kometa\User Data\Default\Login Data 0x2dc51:$a5: \Kometa\User Data\Default\Login Data 0x45c71:$a5: \Kometa\User Data\Default\Login Data
0.2.PO1234.001.exe.43eaa40.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.PO1234.001.exe.43eaa40.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO1234.001.exe.43eaa40.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.PO1234.001.exe.43eaa40.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x101a5:$a1: get_encryptedPassword 0x281c5:$a1: get_encryptedPassword 0x104e1:$a2: get_encryptedUsername 0x28501:$a2: get_encryptedUsername 0xff32:$a3: get_timePasswordChanged 0x27f52:$a3: get_timePasswordChanged 0x10053:$a4: get_passwordField 0x28073:$a4: get_passwordField 0x101bb:$a5: set_encryptedPassword 0x281db:$a5: set_encryptedPassword 0x11b8b:$a7: get_logins 0x29bab:$a7: get_logins 0x1183c:$a8: GetOutlookPasswords 0x2985c:$a8: GetOutlookPasswords 0x1161a:$a9: StartKeylogger 0x2963a:$a9: StartKeylogger 0x11adb:$a10: KeyLoggerEventArgs 0x29afb:$a10: KeyLoggerEventArgs 0x11677:$a11: KeyLoggerEventArgsEventHandler 0x29697:$a11: KeyLoggerEventArgsEventHandler
0.2.PO1234.001.exe.43eaa40.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1541d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2d43d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1491b:$a3: \Google\Chrome\User Data\Default\Login Data 0x2c93b:$a3: \Google\Chrome\User Data\Default\Login Data 0x14c29:$a4: \Orbitum\User Data\Default\Login Data 0x2cc49:$a4: \Orbitum\User Data\Default\Login Data 0x15a21:$a5: \Kometa\User Data\Default\Login Data 0x2da41:$a5: \Kometa\User Data\Default\Login Data
0.2.PO1234.001.exe.438a1c0.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.PO1234.001.exe.438a1c0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO1234.001.exe.438a1c0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.PO1234.001.exe.438a1c0.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x587f5:$a1: get_encryptedPassword 0x70a25:$a1: get_encryptedPassword 0x88a45:$a1: get_encryptedPassword 0x58b31:$a2: get_encryptedUsername 0x70d61:$a2: get_encryptedUsername 0x88d81:$a2: get_encryptedUsername 0x58582:$a3: get_timePasswordChanged 0x707b2:$a3: get_timePasswordChanged 0x887d2:$a3: get_timePasswordChanged 0x586a3:$a4: get_passwordField 0x708d3:$a4: get_passwordField 0x888f3:$a4: get_passwordField 0x5880b:$a5: set_encryptedPassword 0x70a3b:$a5: set_encryptedPassword 0x88a5b:$a5: set_encryptedPassword 0x5a1db:$a7: get_logins 0x7240b:$a7: get_logins 0x8a42b:$a7: get_logins 0x59e8c:$a8: GetOutlookPasswords 0x720bc:$a8: GetOutlookPasswords 0x8a0dc:$a8: GetOutlookPasswords
0.2.PO1234.001.exe.438a1c0.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x5da6d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x75c9d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x8dcbd:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5cf6b:$a3: \Google\Chrome\User Data\Default\Login Data 0x7519b:$a3: \Google\Chrome\User Data\Default\Login Data 0x8d1bb:$a3: \Google\Chrome\User Data\Default\Login Data 0x5d279:$a4: \Orbitum\User Data\Default\Login Data 0x754a9:$a4: \Orbitum\User Data\Default\Login Data 0x8d4c9:$a4: \Orbitum\User Data\Default\Login Data 0x5e071:$a5: \Kometa\User Data\Default\Login Data 0x762a1:$a5: \Kometa\User Data\Default\Login Data 0x8e2c1:$a5: \Kometa\User Data\Default\Login Data
Click to see the 25 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.176.9.81, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 796, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49738

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T03:14:01.309114+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49731	158.101.44.242	80	TCP
2025-01-22T03:14:07.731089+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49731	158.101.44.242	80	TCP
2025-01-22T03:14:30.090620+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49745	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO1234.001.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "carlos@instalacionestasende.com", "Password": "VzX79@6v", "Server": "webmail.instalacionestasende.com"}

Multi AV Scanner detection for submitted file

Source: PO1234.001.exe	Virustotal: Detection: 55%			Perma Link
Source: PO1234.001.exe	ReversingLabs: Detection: 43%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO1234.001.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: PO1234.001.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49734 version: TLS 1.0

Source: PO1234.001.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Stubs Fully\Public\Public Runpe\PR\PR\obj\Debug\Poses.pdb source: PO1234.001.exe, 00000000.00000002.1702325853.0000000005890000.00000004.08000000.00040000.00000000.sdmp, PO1234.001.exe, 00000000.00000002.1700826021.0000000003321000.00000004.00000800.00020000.00000000.sdmp, PO1234.001.exe, 00000000.00000002.1700826021.000000000338B000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 01975782h	1_2_01975358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 019751B9h	1_2_01974F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 01975782h	1_2_01975366
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 01975782h	1_2_019756AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 072FA176h	1_2_072F9FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 072FA176h	1_2_072FA0C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	1_2_072F9F07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	1_2_072F9EC9

Source: global traffic

TCP traffic: 192.168.2.4:62834 -> 162.159.36.2:53

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View

ASN Name: INFORTELECOM-ASES INFORTELECOM-ASES

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49745 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49731 -> 158.101.44.242:80

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 185.176.9.81:25

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49734 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: webmail.instalacionestasende.com

Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegAsm.exe, 00000001.00000002.4144742712.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4149906136.0000000006770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: PO1234.001.exe, 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegAsm.exe, 00000001.00000002.4151860074.0000000008F30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: RegAsm.exe, 00000001.00000002.4144742712.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO1234.001.exe, 00000000.00000002.1710564529.0000000007712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: PO1234.001.exe, 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: PO1234.001.exe, 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, UltraSpeed.cs	.Net Code: TakeScreenshot
Source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, UltraSpeed.cs	.Net Code: TakeScreenshot

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode
Source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.PO1234.001.exe.43eaa40.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PO1234.001.exe.43eaa40.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.PO1234.001.exe.43d2810.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PO1234.001.exe.43d2810.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.PO1234.001.exe.438a1c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PO1234.001.exe.438a1c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: PO1234.001.exe PID: 6636, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegAsm.exe PID: 796, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: 77540000 page read and write

Jump to behavior

Source: C:\Users\user\Desktop\PO1234.001.exe	Code function: 0_2_0181CE7C	0_2_0181CE7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0197C168	1_2_0197C168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0197CA58	1_2_0197CA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01972DD1	1_2_01972DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01974F08	1_2_01974F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01977E68	1_2_01977E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0197C386	1_2_0197C386
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0197B9E0	1_2_0197B9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01974EF8	1_2_01974EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01977E63	1_2_01977E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_072F9700	1_2_072F9700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_072F6608	1_2_072F6608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_072F6618	1_2_072F6618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_072F96F1	1_2_072F96F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_072F4B34	1_2_072F4B34

Source: PO1234.001.exe, 00000000.00000000.1686163719.0000000000F92000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNothing.exe0 vs PO1234.001.exe
Source: PO1234.001.exe, 00000000.00000002.1700050878.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO1234.001.exe
Source: PO1234.001.exe, 00000000.00000002.1700826021.000000000338B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePoses.dll, vs PO1234.001.exe
Source: PO1234.001.exe, 00000000.00000002.1700826021.000000000338B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs PO1234.001.exe
Source: PO1234.001.exe, 00000000.00000002.1702325853.000000000589C000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePoses.dll, vs PO1234.001.exe
Source: PO1234.001.exe, 00000000.00000002.1703047246.0000000005D30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAntiBossing.dll8 vs PO1234.001.exe
Source: PO1234.001.exe, 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAntiBossing.dll8 vs PO1234.001.exe
Source: PO1234.001.exe, 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs PO1234.001.exe
Source: PO1234.001.exe	Binary or memory string: OriginalFilenameNothing.exe0 vs PO1234.001.exe

Source: PO1234.001.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.PO1234.001.exe.43eaa40.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PO1234.001.exe.43eaa40.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO1234.001.exe.43d2810.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PO1234.001.exe.43d2810.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO1234.001.exe.438a1c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PO1234.001.exe.438a1c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: PO1234.001.exe PID: 6636, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegAsm.exe PID: 796, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: PO1234.001.exe, ExcavationTask.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO1234.001.exe.438a1c0.3.raw.unpack, FuelfordChassis.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO1234.001.exe.5d30000.6.raw.unpack, FuelfordChassis.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@4/4

Source: C:\Users\user\Desktop\PO1234.001.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO1234.001.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutant created: NULL

Source: PO1234.001.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO1234.001.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\PO1234.001.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO1234.001.exe	Virustotal: Detection: 55%
Source: PO1234.001.exe	ReversingLabs: Detection: 43%

Source: unknown	Process created: C:\Users\user\Desktop\PO1234.001.exe "C:\Users\user\Desktop\PO1234.001.exe"
Source: C:\Users\user\Desktop\PO1234.001.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\PO1234.001.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO1234.001.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PO1234.001.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PO1234.001.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO1234.001.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Source: PO1234.001.exe

Static PE information: 0xFEBA3976 [Fri Jun 5 03:54:30 2105 UTC]

Source: C:\Users\user\Desktop\PO1234.001.exe

Code function: 0_2_0181E6E0 push esp; retf

0_2_0181E6E1

Source: PO1234.001.exe

Static PE information: section name: .text entropy: 7.78734160032619

Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO1234.001.exe PID: 6636, type: MEMORYSTR

Source: C:\Users\user\Desktop\PO1234.001.exe	Memory allocated: 1810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Memory allocated: 3140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 32E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 52E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO1234.001.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1036	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8804	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 1775	Jump to behavior

Source: C:\Users\user\Desktop\PO1234.001.exe TID: 3300	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -99763s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -99110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -98999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -98891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -98766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -98641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -98419s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -98094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -97984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -97875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -97766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -97641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -97516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -97406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -97297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -97188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -97063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -96938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -96828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -96719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -96594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -96235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -96110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -95860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -95735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -95610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -95485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -95360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -95235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -95110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -94985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -94860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -94735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -94610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -94485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -94360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6640	Thread sleep time: -94235s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PO1234.001.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99763	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98419	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 94235	Jump to behavior

Source: RegAsm.exe, 00000001.00000002.4143867436.0000000001701000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0197C168 LdrInitializeThunk,LdrInitializeThunk,

1_2_0197C168

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PO1234.001.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.PO1234.001.exe.337f2e8.0.raw.unpack, EngineAlgorithm.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.PO1234.001.exe.337f2e8.0.raw.unpack, EngineAlgorithm.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)

Source: C:\Users\user\Desktop\PO1234.001.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD:n
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,,8
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qd{s
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qHe4
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt[D
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<Kb
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4~<
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qh z
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^ql@
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPRq
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,+L
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT\4
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8!t
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<*X
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qHce
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qprl
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qWR
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPuJ
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qh h
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`2B
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX.
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<n4
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8"k
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(es
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q wM
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX`
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT}]
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0vY
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD]G
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|I\|
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\+>
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qLnF
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8=
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|lC
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$]x
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8:
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qp2W
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q87
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qlh\|
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|#
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(Ak
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8l
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|/
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8i
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`QW
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^ql
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,*C
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdzD
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qp
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|H;
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qo
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<jm
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qDzu
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\(@
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4\|G
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q tO
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH!Q
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL4
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\)I
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhbV
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX ]
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|jN
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qd\|9
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qlI_
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q9l
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT9T
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\JS
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\,
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\*5
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qtYO
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|8
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD{~
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qd8`
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<N
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qXAg
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qty{
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4:c
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qxab
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$A6
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$aT
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt\
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4``
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qE
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4(
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qd=~
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$@J
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0yW
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4$
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`X?
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPy4
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx&6
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@xc
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qh%e
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qtP
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(ig
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,qj
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\OF
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(H]
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT3
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q]
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH(9
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8Hh
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0ZB
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q zq
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhi>
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qu^
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4<
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\.t
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qd
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT@<
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<rE
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt_q
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|oy
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qlqK
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qh
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q40
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qP
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^ql.Q
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qlNr
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt^z
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qN
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD`}
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qTY
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qSv
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qU4
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`6o
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhFw
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx%
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qXDe
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPw?
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|mL
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT\~
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx"
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q5?
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q Vi
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\mr
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt;i
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX#[
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|n8
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(gh
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qxCV
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$?A
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qh"g
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt]9
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|*_
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL,b
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD_<
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<,m
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,-y
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qLp;
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX"
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`vv
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q6H
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPUo
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qXew
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q 7^
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH&D
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8Fs
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0XM
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPxH
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx$A
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx9
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT>G
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,P@
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(gz
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX;;
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx\|@
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL"L
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qd1n
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@l^
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0LH
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(=>
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qP,
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qh8}
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qpI
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|AS
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8}h
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|!5
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qpU
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL#8
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4UA
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\!X
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qpR
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qp)P
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPU
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qTu<
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qtt]
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`*j
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q43q
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<Cy
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx}I
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH~C
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX]N
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qDTx
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<Dp
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4VJ
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qxZp
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0)
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`L:
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0&
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q05
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPl{
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qps
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0N=
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPR
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qlBm
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qtRu
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdTG
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0+v
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qP\|
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0[
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhyp
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qlA4
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qTPn
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<B8
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$tA
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT0M
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(:@
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@(U
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\am
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdqu
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qr`
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qP'a
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx6h
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qDS4
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qphf
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q/f
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\`v
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx84
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPk:
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdPc
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH8k
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q )d
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerH
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`JE
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0)o
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4tV
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPIj
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q m=
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT'
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$2]
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL!C
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\| I
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<Ar
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q Jv
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx8g
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<dK
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH\|N
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL%p
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qT5x
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qlW
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|FF
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD7J
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qh_X
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX=s
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@/=
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8@Q
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$7{
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH?]
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$8Y
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX`L
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qlB
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD86
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`pB
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qDXT
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qTW`
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qlK
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qtw[
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qLI5
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qLW
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qLiS
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,(N
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qMB
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH`g
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$Yc
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qLHI
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qP.i
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4Yn
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qLH
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX?h
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q00a
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@qq
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(c;
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\h_
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q 0l
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(@t
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPP\
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,+
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qLK
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,IX
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt7<
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8^]
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qtS~
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,T
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q+r
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4W6
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$Ve
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8<u
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4wT
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx;e
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q n~
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,`
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$5[
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qTvk
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<h5
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qp+E
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,gd
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qleF
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx~5
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX~X
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,FZ
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX}z
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<gI
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@Mi
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(_Q
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qp-:
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qO7
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH^h
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qoU
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q Oa
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0pP
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD6A
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt5G
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@o\
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdV<
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qNK
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^ql#b
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qLG@
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL$y
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qnl
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$xn
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`c^
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL[f
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(Tb
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPCH
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8uQ
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx2;
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdlJ
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(2z
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q "r
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(3X
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4mD
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhD
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdIq
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\[K
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qDLO
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q EK
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhA
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<}d
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^ql{a
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\\|U
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<\Z
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$M^
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4nM
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH4>
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q F7
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@$4
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qDmY
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0ea
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qpc{
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhv
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPE=
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@el
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8wF
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdm6
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qHA
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qP"v
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qHM
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4o9
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhuC
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4-4
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,<j
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q'E
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt'M
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\98
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4kO
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH1@
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qDj[
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|z=
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q cW
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qtHW
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qh/k
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,z\|
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qDJ4
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q):
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qpb:
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(V
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx/`
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|6d
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8S>
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhQ;
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(J
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@d=
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@Av
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qxrZ
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhsN
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^ql?
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(w
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qh0T
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qXR_
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|Xm
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$li
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qP o
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX0w
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qH2I
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q DB
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\8r
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qHXF
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qt,x
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qtO?
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q8Wk
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPF~
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q Ho
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(Xw
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q z
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<@C
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q,`r
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qx4s
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`&=
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdo
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|__
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^ql`S
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^ql@5
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qX7Q
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\?d
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD.{
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qpG\
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(z_
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPiE
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`HP
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qHZ;
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qD>
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qxWL
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qC\
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qXW}
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qDF
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdf
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|=w
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q kH
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^ql?I
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q419
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhWg
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q@e~
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qxuX
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$O
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qxtz
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhvL
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|\a
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qDx
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q`$H
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^ql]U
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0%B
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhw8
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL=Z
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q(6V
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q85b
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qd{
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qHVQ
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdKx
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q4M{
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qxTN
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$G
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qdn?
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$C
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qPgP
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qtnT
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qhUh
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q%P
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qpg4
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q0&K
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qL^d
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qHv}
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^qxVC
Source: RegAsm.exe, 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q<>N
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q\|~j
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerDk
Source: RegAsm.exe, 00000001.00000002.4144742712.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q$Os

Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Users\user\Desktop\PO1234.001.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1234.001.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO1234.001.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.PO1234.001.exe.43eaa40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43d2810.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.438a1c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO1234.001.exe PID: 6636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 796, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.PO1234.001.exe.43eaa40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43d2810.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.438a1c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO1234.001.exe PID: 6636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 796, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 0.2.PO1234.001.exe.43eaa40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43d2810.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.438a1c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO1234.001.exe PID: 6636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 796, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.PO1234.001.exe.43eaa40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43d2810.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.438a1c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO1234.001.exe PID: 6636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 796, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.PO1234.001.exe.43eaa40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43d2810.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43d2810.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.43eaa40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO1234.001.exe.438a1c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4142068190.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700949684.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4144742712.0000000003321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO1234.001.exe PID: 6636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 796, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	13 System Information Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	12 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Email Collection	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Application Window Discovery	SSH	1 Input Capture	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	1 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO1234.001.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
PO1234.001.exe