Analysis Report NewPO.com

AV Detection:

Found malware configuration

Source: 00000000.00000002.842923779.0000000000460000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "http://avicennamch.com/osita/bin_ygJfz82.bin;]"}

Multi AV Scanner detection for submitted file

Source: NewPO.exe	Virustotal: Detection: 30%			Perma Link
Source: NewPO.exe	ReversingLabs: Detection: 10%

Compliance:

Uses 32bit PE files

Source: NewPO.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 136.243.220.59:443 -> 192.168.2.4:49765 version: TLS 1.2

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://avicennamch.com/osita/bin_ygJfz82.bin;]

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /osita/bin_ygJfz82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: avicennamch.comCache-Control: no-cache

Found strings which match to known social media urls

Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp

String found in binary or memory: src="https://www.facebook.com/tr?id=210115193827189&ev=PageView equals www.facebook.com (Facebook)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: avicennamch.com

URLs found in memory or binary data

Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.bin
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.bin#
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.bin&0
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.bin)
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.bin0
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.binK
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.binMh2
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.binT
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.binX
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.bincrl0
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.binital
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.binmch.com
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.bins
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.binternet
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.binw
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://avicennamch.com/osita/bin_ygJfz82.binx
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://r3.i.lencr.org/0-
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://x1.i.lencr.org
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: http://x1.i.lencr.org/f
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https:////maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=5.4.5
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp, NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://api.w.org/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/#website
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/2020/03/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/2020/03/31/inauguration-of-avicenna-dental-college/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/2020/10/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/2020/10/08/pakistan-association-of-private-medical-dental-institutions-pami/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/2020/10/08/sehat-insaf-card-program-of-government-of-pakistan/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/?page_id=2452
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/?page_id=3669
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/?page_id=3671
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/?s=
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/abdul-waheed-trust/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/about-us/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adc-dental-materials/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/adc-events/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adc-oral-biology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adc-oral-medicine/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adc-oral-pathology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adc-oral-surgery/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adc-orthodontics/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adc-periodontology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adc-prosthodontics/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/adc-sports-day/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/adc-student-testimonials/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adc/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adh-dental-materials/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/adh-operative-dentistry/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/adh-oral-mexillofacial-surgery/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/adh-oral-pathology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adh-orthodontics/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/adh-periodontology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/adh-prosthodontics/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/admissions-bds/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/admissions-criteria-for-foreign-students/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/admissions-mbbs/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/admissions/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/allied-health-sciences/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-basic-sciences-biochemistry/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-basic-sciences-community-medicine/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-basic-sciences-forensic-medicine/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-basic-sciences-pathology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-basic-sciences-pharmacology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-basic-sciences-physiology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-bcs-anatomy/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-anesthesiology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-dermatology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-ent/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp, NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-medicine/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-obstetrics-and-gynecology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-ophthalmology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-orthopedics/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-paediatrics/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-psychiatry-and-behavioral-sciences/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-radiology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc-clinical-sciences-surgery/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/amc-student-testimonials/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amc/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amh-anesthesiology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amh-dermatology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amh-ent/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amh-obstetrics-and-gynecology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amh-ophthalmology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amh-paediatrics/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amh-radiology/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/amh-surgery/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/avicenna-dental-hospital/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/avicenna-medical-hospital-medicine/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/avicenna-medical-hospital/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/blank/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/careers-working/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/careers/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/category/main-news/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/category/uncategorized/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/chairman-awt/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/co-chairperson-admin-legal-and-finanace/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/co-chairperson-development-and-coordination/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/comments/feed/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/contact-us/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/covid-19/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/director-adil-hospital/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/events-avicenna-medical-college/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/fee-schedules/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/feed/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/gnc/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/in
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/life-at-adc/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/life-at-amc-excursion-and-trips/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/life-at-amc/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/members-board-of-governors/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/members-board-of-trustees/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/merit-list/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/news-and-media/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/orthopedics/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/osita/bin_ygJfz82.bin
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/osita/bin_ygJfz82.bin1
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/overview/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/privacy-policy/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/quality-standards/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/registration-and-affiliation/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/sports-day/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/thank-you/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/vision-mission/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wfme-standards/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/LayerSlider/assets/static/layerslider/css/layerslider.css
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/layerslider.krea
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/layerslider.tran
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/layerslider.util
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/addons-for-elementor-premium/assets/css/animate.css?ver=2
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/addons-for-elementor-premium/assets/css/icomoon.css?ver=2
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/addons-for-elementor-premium/assets/css/lae-frontend.css?
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/addons-for-elementor-premium/assets/css/lae-widgets.css?v
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/addons-for-elementor-premium/assets/css/premium/jquery.fa
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/addons-for-elementor-premium/assets/css/premium/lae-block
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/addons-for-elementor-premium/assets/css/premium/lae-front
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/addons-for-elementor-premium/assets/css/premium/lae-widge
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/addons-for-elementor-premium/assets/css/premium/sliders.c
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/addons-for-elementor-premium/assets/css/sliders.css?ver=2
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/bdthemes-element-pack/assets/css/bdt-uikit.css?ver=3.2
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/bdthemes-element-pack/assets/css/element-pack-site.css?ve
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/bdthemes-element-pack/assets/js/bdt-uikit.min.js?ver=4.7.
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/bdthemes-element-pack/assets/js/element-pack-site.min.js?
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=2.9.3
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=2.9.3
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?ver=
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=2.9.7
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=2.9.7
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=2.9.7
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=2.
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.7.6
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?v
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=162
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?ve
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver=
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=2.9
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementskit-lite/libs/framework/assets/js/frontend-script
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementskit-lite/modules/controls/assets/css/ekiticons.cs
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementskit-lite/modules/controls/assets/css/widgetarea-e
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementskit-lite/modules/controls/assets/js/widgetarea-ed
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementskit-lite/widgets/init/assets/css/responsive.css?v
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementskit-lite/widgets/init/assets/css/widget-styles-pr
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementskit-lite/widgets/init/assets/css/widget-styles.cs
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementskit-lite/widgets/init/assets/js/elementor.js?ver=
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementskit-lite/widgets/init/assets/js/gmaps.min.js?ver=
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/elementskit-lite/widgets/init/assets/js/widget-scripts.js
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/jet-elements/assets/css/jet-elements-skin.css?ver=2.2.12
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/jet-elements/assets/css/jet-elements.css?ver=2.2.12
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/jet-elements/assets/js/jet-elements.min.js?ver=2.2.12
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/jet-menu/assets/public/css/public.css?ver=2.0.0-beta
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/jet-menu/assets/public/js/jet-menu-public-script.js?ver=2
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/jet-menu/assets/public/js/jet-menu-widgets-scripts.js?ver
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/jet-menu/assets/public/js/vue.min.js?ver=2.6.11
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/jet-menu/assets/public/lib/font-awesome/css/all.min.css?v
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/jet-menu/assets/public/lib/font-awesome/css/v4-shims.min.
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/menu-icons/css/extra.min.css?ver=0.12.4
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/templately/assets/css/editor.css?ver=1.1.2
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/plugins/wp-smush-pro/app/assets/js/smush-lazy-load.min.js?ver=3.6
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/themes/twentytwenty/assets/js/index.js?ver=1.1
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/themes/twentytwenty/print.css?ver=1.1
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/themes/twentytwenty/style.css?ver=1.1
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/uploads/2020/11/favicon-blue-bg.ico
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/uploads/elementor/css/global.css?ver=1601374295
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-content/uploads/useanyfont/uaf.css?ver=1601368177
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-includes/css/dashicons.min.css?ver=5.4.5
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-includes/css/dist/block-library/style.min.css?ver=5.4.5
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-includes/js/jquery/ui/position.min.js?ver=1.11.4
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-includes/js/wp-embed.min.js?ver=5.4.5
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-includes/wlwmanifest.xml
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp, NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-json/
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://avicennamch.com/wp-json/elementskit/v1/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/wp-login.php
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://avicennamch.com/xmlrpc.php?rsd
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Poppins:300
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://gmpg.org/xfn/11
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://layerslider.kreaturamedia.com
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://maps.googleapis.com/maps/api/js?key&ver=5.4.5
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://schema.org
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://wordpress.org/
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=AW-477806451
Source: NewPO.exe, 0000000F.00000002.1162622019.0000000002450000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-H1WG7SNJKD
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	String found in binary or memory: https://yoast.com/wordpress/plugins/seo/

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 136.243.220.59:443 -> 192.168.2.4:49765 version: TLS 1.2

System Summary:

Potential malicious icon found

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\NewPO.exe

Process Stats: CPU usage > 98%

Detected potential crypto function

Source: C:\Users\user\Desktop\NewPO.exe

Code function: 0_2_0040162C

0_2_0040162C

PE file contains strange resources

Source: NewPO.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: NewPO.exe, 00000000.00000002.843658883.0000000002160000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs NewPO.exe
Source: NewPO.exe, 00000000.00000002.842872338.000000000041B000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamecerebri.exe vs NewPO.exe
Source: NewPO.exe, 00000000.00000002.844203837.0000000002A40000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamecerebri.exeFE2X vs NewPO.exe
Source: NewPO.exe, 0000000F.00000002.1165574898.000000001DF00000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs NewPO.exe
Source: NewPO.exe, 0000000F.00000002.1165540753.000000001DC60000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs NewPO.exe
Source: NewPO.exe, 0000000F.00000000.841272047.000000000041B000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamecerebri.exe vs NewPO.exe
Source: NewPO.exe	Binary or memory string: OriginalFilenamecerebri.exe vs NewPO.exe

Uses 32bit PE files

Source: NewPO.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Classification label

Source: classification engine

Classification label: mal92.rans.troj.evad.winEXE@2/0@1/1

PE file has an executable .text section and no other executable section

Source: NewPO.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\NewPO.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\NewPO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\NewPO.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: NewPO.exe	Virustotal: Detection: 30%
Source: NewPO.exe	ReversingLabs: Detection: 10%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\NewPO.exe 'C:\Users\user\Desktop\NewPO.exe'
Source: C:\Users\user\Desktop\NewPO.exe	Process created: C:\Users\user\Desktop\NewPO.exe 'C:\Users\user\Desktop\NewPO.exe'

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.842923779.0000000000460000.00000040.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_0040505D push DDF30414h; ret		0_2_00405051
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_00405019 push DDF30414h; ret		0_2_00405051
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_00406C1F push 00000076h; ret		0_2_00406C22
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_00406897 push 0000007Eh; retf		0_2_0040689E
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_004064AA pushad ; ret		0_2_004064B5
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_004064BE pushad ; ret		0_2_004064B5
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_0040754D push ecx; ret		0_2_00407551
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_00407995 pushfd ; ret		0_2_0040799A
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_0040119C pushad ; iretd		0_2_004011AB
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_00406212 pushad ; ret		0_2_00406215
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_00406219 pushad ; ret		0_2_00406215
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_00405EE0 pushad ; ret		0_2_00405EE5
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 0_2_00407FE1 push ecx; ret		0_2_00407FE6
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 15_2_00560036 pushad ; retf		15_2_00560037
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 15_2_00563DCF push ss; retf		15_2_00563DD0
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 15_2_0056458A push esi; ret		15_2_0056458B
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 15_2_005600BA pushad ; retf		15_2_005600BB
Source: C:\Users\user\Desktop\NewPO.exe	Code function: 15_2_005634B8 push 7359FEC5h; retf 0045h		15_2_005634BD

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\NewPO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\NewPO.exe	RDTSC instruction interceptor: First address: 0000000000466389 second address: 0000000000466389 instructions:
Source: C:\Users\user\Desktop\NewPO.exe	RDTSC instruction interceptor: First address: 00000000004653B9 second address: 00000000004653B9 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FB528B22F48h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d jmp 00007FB528B22F56h 0x0000001f push eax 0x00000020 jmp 00007FB528B22F75h 0x00000022 call 00007FB528B22F25h 0x00000027 pop eax 0x00000028 jmp eax 0x0000002a pop eax 0x0000002b test eax, eax 0x0000002d add edi, edx 0x0000002f dec dword ptr [ebp+000000F8h] 0x00000035 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000003c jne 00007FB528B22ED5h 0x0000003e cmp cx, bx 0x00000041 call 00007FB528B22FD6h 0x00000046 call 00007FB528B22F58h 0x0000004b lfence 0x0000004e mov edx, dword ptr [7FFE0014h] 0x00000054 lfence 0x00000057 ret 0x00000058 mov esi, edx 0x0000005a pushad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\NewPO.exe	RDTSC instruction interceptor: First address: 0000000000460A1E second address: 0000000000460A1E instructions:

Tries to detect Any.run

Source: C:\Users\user\Desktop\NewPO.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\NewPO.exe	RDTSC instruction interceptor: First address: 0000000000466389 second address: 0000000000466389 instructions:
Source: C:\Users\user\Desktop\NewPO.exe	RDTSC instruction interceptor: First address: 00000000004653B9 second address: 00000000004653B9 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FB528B22F48h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d jmp 00007FB528B22F56h 0x0000001f push eax 0x00000020 jmp 00007FB528B22F75h 0x00000022 call 00007FB528B22F25h 0x00000027 pop eax 0x00000028 jmp eax 0x0000002a pop eax 0x0000002b test eax, eax 0x0000002d add edi, edx 0x0000002f dec dword ptr [ebp+000000F8h] 0x00000035 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000003c jne 00007FB528B22ED5h 0x0000003e cmp cx, bx 0x00000041 call 00007FB528B22FD6h 0x00000046 call 00007FB528B22F58h 0x0000004b lfence 0x0000004e mov edx, dword ptr [7FFE0014h] 0x00000054 lfence 0x00000057 ret 0x00000058 mov esi, edx 0x0000005a pushad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\NewPO.exe	RDTSC instruction interceptor: First address: 00000000004653ED second address: 00000000004653ED instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FB52874A5FCh 0x0000001d popad 0x0000001e call 00007FB52874A22Fh 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\NewPO.exe	RDTSC instruction interceptor: First address: 0000000000460A1E second address: 0000000000460A1E instructions:
Source: C:\Users\user\Desktop\NewPO.exe	RDTSC instruction interceptor: First address: 00000000005653ED second address: 00000000005653ED instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FB52874A5FCh 0x0000001d popad 0x0000001e call 00007FB52874A22Fh 0x00000023 lfence 0x00000026 rdtsc

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\NewPO.exe TID: 6416	Thread sleep count: 81 > 30			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe TID: 6416	Thread sleep time: -810000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\NewPO.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\NewPO.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: NewPO.exe, 0000000F.00000002.1162410140.00000000008E9000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW=

Anti Debugging:

Hides threads from debuggers

Source: C:\Users\user\Desktop\NewPO.exe

Thread information set: HideFromDebugger

Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\NewPO.exe

Process queried: DebugPort

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: NewPO.exe, 0000000F.00000002.1162559934.0000000000F30000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: NewPO.exe, 0000000F.00000002.1162559934.0000000000F30000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: NewPO.exe, 0000000F.00000002.1162559934.0000000000F30000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: NewPO.exe, 0000000F.00000002.1162559934.0000000000F30000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\NewPO.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\NewPO.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior