Edit tour

Windows Analysis Report
3vj5tYFb6a.exe

Overview

General Information

Sample Name:	3vj5tYFb6a.exe
Original Sample Name:	10243ce788b5dcbbf248058fe196f371.exe
Analysis ID:	1334037
MD5:	10243ce788b5dcbbf248058fe196f371
SHA1:	0da95887908b6ada23c698de6cf2f3f986655721
SHA256:	8bf51ccb2646d38af6778a0712c78415e113b1393509afdc16c97a0bfb91eb55
Tags:	exe
Infos:

Detection

Snake Keylogger, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Yara detected zgRAT

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Writes to foreign memory regions

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Yara detected Generic Downloader

.NET source code contains method to dynamically call methods (often used by packers)

Creates an undocumented autostart registry key

Uses ipconfig to lookup or modify the Windows network settings

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

One or more processes crash

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

May check the online IP address of the machine

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Drops PE files

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

3vj5tYFb6a.exe (PID: 2640 cmdline: C:\Users\user\Desktop\3vj5tYFb6a.exe MD5: 10243CE788B5DCBBF248058FE196F371)

conhost.exe (PID: 1976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1400 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7232 cmdline: "C:\Windows\system32\ipconfig.exe" /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

powershell.exe (PID: 7252 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7412 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7564 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7764 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8144 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5908 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 6000 cmdline: "C:\Windows\system32\ipconfig.exe" /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

aspnet_compiler.exe (PID: 7512 cmdline: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)

WerFault.exe (PID: 7648 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7512 -s 2204 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord https://blogs.blackberry.com/en/2022/06/threat-thursday-unique-delivery-method-for-snake-keylogger https://cert.gov.ua/article/955924	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "noni@ehrgeizig2021.xyz", "Password": "Moneymatter@123", "Host": "mail.privateemail.com"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13c4d:$a1: get_encryptedPassword 0x13f39:$a2: get_encryptedUsername 0x13a59:$a3: get_timePasswordChanged 0x13b54:$a4: get_passwordField 0x13c63:$a5: set_encryptedPassword 0x15268:$a7: get_logins 0x151cb:$a10: KeyLoggerEventArgs 0x14e3b:$a11: KeyLoggerEventArgsEventHandler
00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1750c:$x1: $%SMTPDV$ 0x17522:$x2: $#TheHashHere%& 0x1886c:$x3: %FTPDV$ 0x18934:$x4: $%TelegramDv$ 0x14e3b:$x5: KeyLoggerEventArgs 0x151cb:$x5: KeyLoggerEventArgs 0x188dc:$m1: \| Snake Keylogger 0x18994:$m1: \| Snake Keylogger 0x18ae8:$m1: \| Snake Keylogger 0x18c0e:$m1: \| Snake Keylogger 0x18d68:$m1: \| Snake Keylogger 0x18890:$m2: Clipboard Logs ID 0x18a9e:$m2: Screenshot Logs ID 0x18bb2:$m2: keystroke Logs ID 0x18d9e:$m3: SnakePW 0x18a76:$m4: \SnakeKeylogger\
00000000.00000002.2691462788.0000000005090000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1490d:$a1: get_encryptedPassword 0x14bf9:$a2: get_encryptedUsername 0x14719:$a3: get_timePasswordChanged 0x14814:$a4: get_passwordField 0x14923:$a5: set_encryptedPassword 0x15f28:$a7: get_logins 0x15e8b:$a10: KeyLoggerEventArgs 0x15afb:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x181cc:$x1: $%SMTPDV$ 0x181e2:$x2: $#TheHashHere%& 0x1952c:$x3: %FTPDV$ 0x195f4:$x4: $%TelegramDv$ 0x15afb:$x5: KeyLoggerEventArgs 0x15e8b:$x5: KeyLoggerEventArgs 0x1959c:$m1: \| Snake Keylogger 0x19654:$m1: \| Snake Keylogger 0x197a8:$m1: \| Snake Keylogger 0x198ce:$m1: \| Snake Keylogger 0x19a28:$m1: \| Snake Keylogger 0x19550:$m2: Clipboard Logs ID 0x1975e:$m2: Screenshot Logs ID 0x19872:$m2: keystroke Logs ID 0x19a5e:$m3: SnakePW 0x19736:$m4: \SnakeKeylogger\
00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1425d:$a1: get_encryptedPassword 0x878ed:$a1: get_encryptedPassword 0x14549:$a2: get_encryptedUsername 0x87bd9:$a2: get_encryptedUsername 0x14069:$a3: get_timePasswordChanged 0x876f9:$a3: get_timePasswordChanged 0x14164:$a4: get_passwordField 0x877f4:$a4: get_passwordField 0x14273:$a5: set_encryptedPassword 0x87903:$a5: set_encryptedPassword 0x15878:$a7: get_logins 0x88f08:$a7: get_logins 0x157db:$a10: KeyLoggerEventArgs 0x88e6b:$a10: KeyLoggerEventArgs 0x1544b:$a11: KeyLoggerEventArgsEventHandler 0x88adb:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17b1c:$x1: $%SMTPDV$ 0x8b1ac:$x1: $%SMTPDV$ 0x17b32:$x2: $#TheHashHere%& 0x8b1c2:$x2: $#TheHashHere%& 0x18e7c:$x3: %FTPDV$ 0x8c50c:$x3: %FTPDV$ 0x18f44:$x4: $%TelegramDv$ 0x8c5d4:$x4: $%TelegramDv$ 0x1544b:$x5: KeyLoggerEventArgs 0x157db:$x5: KeyLoggerEventArgs 0x88adb:$x5: KeyLoggerEventArgs 0x88e6b:$x5: KeyLoggerEventArgs 0x18eec:$m1: \| Snake Keylogger 0x18fa4:$m1: \| Snake Keylogger 0x190f8:$m1: \| Snake Keylogger 0x1921e:$m1: \| Snake Keylogger 0x19378:$m1: \| Snake Keylogger 0x8c57c:$m1: \| Snake Keylogger 0x8c634:$m1: \| Snake Keylogger 0x8c788:$m1: \| Snake Keylogger 0x8c8ae:$m1: \| Snake Keylogger
00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2ab9d:$a1: get_encryptedPassword 0x45d59:$a1: get_encryptedPassword 0x16e89:$a2: get_encryptedUsername 0x2a9a9:$a3: get_timePasswordChanged 0x45b65:$a3: get_timePasswordChanged 0x2aaa4:$a4: get_passwordField 0x45c60:$a4: get_passwordField 0x2abb3:$a5: set_encryptedPassword 0x45d6f:$a5: set_encryptedPassword 0x181b8:$a7: get_logins 0x1811b:$a10: KeyLoggerEventArgs 0x17d8b:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1a45c:$x1: $%SMTPDV$ 0x1a472:$x2: $#TheHashHere%& 0xcf54:$x3: %FTPDV$ 0x1b7bc:$x3: %FTPDV$ 0xd01c:$x4: $%TelegramDv$ 0x1b884:$x4: $%TelegramDv$ 0x17d8b:$x5: KeyLoggerEventArgs 0x1811b:$x5: KeyLoggerEventArgs 0xcfc4:$m1: \| Snake Keylogger 0xd07c:$m1: \| Snake Keylogger 0xd1d0:$m1: \| Snake Keylogger 0xd2f6:$m1: \| Snake Keylogger 0xd450:$m1: \| Snake Keylogger 0x1b82c:$m1: \| Snake Keylogger 0x1b8e4:$m1: \| Snake Keylogger 0x1ba38:$m1: \| Snake Keylogger 0x1bb5e:$m1: \| Snake Keylogger 0x1bcb8:$m1: \| Snake Keylogger 0xcf78:$m2: Clipboard Logs ID 0xd186:$m2: Screenshot Logs ID 0xd29a:$m2: keystroke Logs ID
00000016.00000002.2745588787.0000000003021000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: 3vj5tYFb6a.exe PID: 2640	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3vj5tYFb6a.exe PID: 2640	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 3vj5tYFb6a.exe PID: 2640	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: 3vj5tYFb6a.exe PID: 2640	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x4ed8c:$a1: get_encryptedPassword 0x7deb5:$a1: get_encryptedPassword 0x9bb34:$a1: get_encryptedPassword 0x4f06e:$a2: get_encryptedUsername 0x79a74:$a2: get_encryptedUsername 0x9be16:$a2: get_encryptedUsername 0x4eba2:$a3: get_timePasswordChanged 0x7dccb:$a3: get_timePasswordChanged 0x9b94a:$a3: get_timePasswordChanged 0x4ec9d:$a4: get_passwordField 0x7ddc6:$a4: get_passwordField 0x9ba45:$a4: get_passwordField 0x4eda2:$a5: set_encryptedPassword 0x7decb:$a5: set_encryptedPassword 0x9bb4a:$a5: set_encryptedPassword 0x5119c:$a7: get_logins 0x7b7dc:$a7: get_logins 0x9df44:$a7: get_logins 0x510ff:$a10: KeyLoggerEventArgs 0x7b73f:$a10: KeyLoggerEventArgs 0x9dea7:$a10: KeyLoggerEventArgs
Process Memory Space: 3vj5tYFb6a.exe PID: 2640	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x50d6f:$x5: KeyLoggerEventArgs 0x510ff:$x5: KeyLoggerEventArgs 0x51a35:$x5: KeyLoggerEventArgs 0x51d90:$x5: KeyLoggerEventArgs 0x7b3b8:$x5: KeyLoggerEventArgs 0x7b73f:$x5: KeyLoggerEventArgs 0x7c075:$x5: KeyLoggerEventArgs 0x7c3d0:$x5: KeyLoggerEventArgs 0x9db17:$x5: KeyLoggerEventArgs 0x9dea7:$x5: KeyLoggerEventArgs 0x9e7dd:$x5: KeyLoggerEventArgs 0x9eb38:$x5: KeyLoggerEventArgs 0x53253:$m1: \| Snake Keylogger 0x532ab:$m1: \| Snake Keylogger 0x5333f:$m1: \| Snake Keylogger 0x533a0:$m1: \| Snake Keylogger 0x53415:$m1: \| Snake Keylogger 0x76c76:$m1: \| Snake Keylogger 0x76cce:$m1: \| Snake Keylogger 0x76d62:$m1: \| Snake Keylogger 0x76dc3:$m1: \| Snake Keylogger
Process Memory Space: aspnet_compiler.exe PID: 7512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 7512	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 7512	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 7512	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x19c9b:$a1: get_encryptedPassword 0x19f7d:$a2: get_encryptedUsername 0x19ab1:$a3: get_timePasswordChanged 0x19bac:$a4: get_passwordField 0x19cb1:$a5: set_encryptedPassword 0x1c0ab:$a7: get_logins 0x1c00e:$a10: KeyLoggerEventArgs 0x1bc7e:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: aspnet_compiler.exe PID: 7512	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1bc7e:$x5: KeyLoggerEventArgs 0x1c00e:$x5: KeyLoggerEventArgs 0x1c944:$x5: KeyLoggerEventArgs 0x1cc9f:$x5: KeyLoggerEventArgs 0x1e162:$m1: \| Snake Keylogger 0x1e1ba:$m1: \| Snake Keylogger 0x1e24e:$m1: \| Snake Keylogger 0x1e2af:$m1: \| Snake Keylogger 0x1e324:$m1: \| Snake Keylogger 0x1e13b:$m2: Clipboard Logs ID 0x1e229:$m2: Screenshot Logs ID 0x1e281:$m2: keystroke Logs ID 0x1e33f:$m3: SnakePW 0x1e215:$m4: \SnakeKeylogger\
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.3vj5tYFb6a.exe.3c63610.7.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.3vj5tYFb6a.exe.5090000.9.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.3vj5tYFb6a.exe.3b835b0.2.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.3vj5tYFb6a.exe.3b835b0.2.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x420fd:$a1: get_encryptedPassword 0x423e9:$a2: get_encryptedUsername 0x41f09:$a3: get_timePasswordChanged 0x42004:$a4: get_passwordField 0x42113:$a5: set_encryptedPassword 0x43718:$a7: get_logins 0x4367b:$a10: KeyLoggerEventArgs 0x432eb:$a11: KeyLoggerEventArgsEventHandler
0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49672:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x4885b:$a3: \Google\Chrome\User Data\Default\Login Data 0x48ca2:$a4: \Orbitum\User Data\Default\Login Data 0x49e23:$a5: \Kometa\User Data\Default\Login Data
0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x42c4f:$s1: UnHook 0x42c56:$s2: SetHook 0x42c5e:$s3: CallNextHook 0x42c6b:$s4: _hook
0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x459bc:$x1: $%SMTPDV$ 0x459d2:$x2: $#TheHashHere%& 0x46d1c:$x3: %FTPDV$ 0x46de4:$x4: $%TelegramDv$ 0x432eb:$x5: KeyLoggerEventArgs 0x4367b:$x5: KeyLoggerEventArgs 0x46d8c:$m1: \| Snake Keylogger 0x46e44:$m1: \| Snake Keylogger 0x46f98:$m1: \| Snake Keylogger 0x470be:$m1: \| Snake Keylogger 0x47218:$m1: \| Snake Keylogger 0x46d40:$m2: Clipboard Logs ID 0x46f4e:$m2: Screenshot Logs ID 0x47062:$m2: keystroke Logs ID 0x4724e:$m3: SnakePW 0x46f26:$m4: \SnakeKeylogger\
0.2.3vj5tYFb6a.exe.3ba35d0.3.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.3vj5tYFb6a.exe.3be35f0.6.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.3vj5tYFb6a.exe.3ba35d0.3.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.3vj5tYFb6a.exe.3be35f0.6.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1204d:$a1: get_encryptedPassword 0x12339:$a2: get_encryptedUsername 0x11e59:$a3: get_timePasswordChanged 0x11f54:$a4: get_passwordField 0x12063:$a5: set_encryptedPassword 0x13668:$a7: get_logins 0x135cb:$a10: KeyLoggerEventArgs 0x1323b:$a11: KeyLoggerEventArgsEventHandler
0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x195c2:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x187ab:$a3: \Google\Chrome\User Data\Default\Login Data 0x18bf2:$a4: \Orbitum\User Data\Default\Login Data 0x19d73:$a5: \Kometa\User Data\Default\Login Data
0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x12b9f:$s1: UnHook 0x12ba6:$s2: SetHook 0x12bae:$s3: CallNextHook 0x12bbb:$s4: _hook
0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1590c:$x1: $%SMTPDV$ 0x15922:$x2: $#TheHashHere%& 0x16c6c:$x3: %FTPDV$ 0x16d34:$x4: $%TelegramDv$ 0x1323b:$x5: KeyLoggerEventArgs 0x135cb:$x5: KeyLoggerEventArgs 0x16cdc:$m1: \| Snake Keylogger 0x16d94:$m1: \| Snake Keylogger 0x16ee8:$m1: \| Snake Keylogger 0x1700e:$m1: \| Snake Keylogger 0x17168:$m1: \| Snake Keylogger 0x16c90:$m2: Clipboard Logs ID 0x16e9e:$m2: Screenshot Logs ID 0x16fb2:$m2: keystroke Logs ID 0x1719e:$m3: SnakePW 0x16e76:$m4: \SnakeKeylogger\
0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
22.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
22.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
22.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
22.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
22.2.aspnet_compiler.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13e4d:$a1: get_encryptedPassword 0x14139:$a2: get_encryptedUsername 0x13c59:$a3: get_timePasswordChanged 0x13d54:$a4: get_passwordField 0x13e63:$a5: set_encryptedPassword 0x15468:$a7: get_logins 0x153cb:$a10: KeyLoggerEventArgs 0x1503b:$a11: KeyLoggerEventArgsEventHandler
0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1204d:$a1: get_encryptedPassword 0x12339:$a2: get_encryptedUsername 0x11e59:$a3: get_timePasswordChanged 0x11f54:$a4: get_passwordField 0x12063:$a5: set_encryptedPassword 0x13668:$a7: get_logins 0x135cb:$a10: KeyLoggerEventArgs 0x1323b:$a11: KeyLoggerEventArgsEventHandler
0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
22.2.aspnet_compiler.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b3c2:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a5ab:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a9f2:$a4: \Orbitum\User Data\Default\Login Data 0x1bb73:$a5: \Kometa\User Data\Default\Login Data
0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x195c2:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x187ab:$a3: \Google\Chrome\User Data\Default\Login Data 0x18bf2:$a4: \Orbitum\User Data\Default\Login Data 0x19d73:$a5: \Kometa\User Data\Default\Login Data
0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x12b9f:$s1: UnHook 0x12ba6:$s2: SetHook 0x12bae:$s3: CallNextHook 0x12bbb:$s4: _hook
0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1590c:$x1: $%SMTPDV$ 0x15922:$x2: $#TheHashHere%& 0x16c6c:$x3: %FTPDV$ 0x16d34:$x4: $%TelegramDv$ 0x1323b:$x5: KeyLoggerEventArgs 0x135cb:$x5: KeyLoggerEventArgs 0x16cdc:$m1: \| Snake Keylogger 0x16d94:$m1: \| Snake Keylogger 0x16ee8:$m1: \| Snake Keylogger 0x1700e:$m1: \| Snake Keylogger 0x17168:$m1: \| Snake Keylogger 0x16c90:$m2: Clipboard Logs ID 0x16e9e:$m2: Screenshot Logs ID 0x16fb2:$m2: keystroke Logs ID 0x1719e:$m3: SnakePW 0x16e76:$m4: \SnakeKeylogger\
0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13e4d:$a1: get_encryptedPassword 0x14139:$a2: get_encryptedUsername 0x13c59:$a3: get_timePasswordChanged 0x13d54:$a4: get_passwordField 0x13e63:$a5: set_encryptedPassword 0x15468:$a7: get_logins 0x153cb:$a10: KeyLoggerEventArgs 0x1503b:$a11: KeyLoggerEventArgsEventHandler
22.2.aspnet_compiler.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1499f:$s1: UnHook 0x149a6:$s2: SetHook 0x149ae:$s3: CallNextHook 0x149bb:$s4: _hook
22.2.aspnet_compiler.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1770c:$x1: $%SMTPDV$ 0x17722:$x2: $#TheHashHere%& 0x18a6c:$x3: %FTPDV$ 0x18b34:$x4: $%TelegramDv$ 0x1503b:$x5: KeyLoggerEventArgs 0x153cb:$x5: KeyLoggerEventArgs 0x18adc:$m1: \| Snake Keylogger 0x18b94:$m1: \| Snake Keylogger 0x18ce8:$m1: \| Snake Keylogger 0x18e0e:$m1: \| Snake Keylogger 0x18f68:$m1: \| Snake Keylogger 0x18a90:$m2: Clipboard Logs ID 0x18c9e:$m2: Screenshot Logs ID 0x18db2:$m2: keystroke Logs ID 0x18f9e:$m3: SnakePW 0x18c76:$m4: \SnakeKeylogger\
0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b3c2:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a5ab:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a9f2:$a4: \Orbitum\User Data\Default\Login Data 0x1bb73:$a5: \Kometa\User Data\Default\Login Data
0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13e4d:$a1: get_encryptedPassword 0x14139:$a2: get_encryptedUsername 0x13c59:$a3: get_timePasswordChanged 0x13d54:$a4: get_passwordField 0x13e63:$a5: set_encryptedPassword 0x15468:$a7: get_logins 0x153cb:$a10: KeyLoggerEventArgs 0x1503b:$a11: KeyLoggerEventArgsEventHandler
0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1499f:$s1: UnHook 0x149a6:$s2: SetHook 0x149ae:$s3: CallNextHook 0x149bb:$s4: _hook
0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b3c2:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a5ab:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a9f2:$a4: \Orbitum\User Data\Default\Login Data 0x1bb73:$a5: \Kometa\User Data\Default\Login Data
0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1499f:$s1: UnHook 0x149a6:$s2: SetHook 0x149ae:$s3: CallNextHook 0x149bb:$s4: _hook
0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1770c:$x1: $%SMTPDV$ 0x17722:$x2: $#TheHashHere%& 0x18a6c:$x3: %FTPDV$ 0x18b34:$x4: $%TelegramDv$ 0x1503b:$x5: KeyLoggerEventArgs 0x153cb:$x5: KeyLoggerEventArgs 0x18adc:$m1: \| Snake Keylogger 0x18b94:$m1: \| Snake Keylogger 0x18ce8:$m1: \| Snake Keylogger 0x18e0e:$m1: \| Snake Keylogger 0x18f68:$m1: \| Snake Keylogger 0x18a90:$m2: Clipboard Logs ID 0x18c9e:$m2: Screenshot Logs ID 0x18db2:$m2: keystroke Logs ID 0x18f9e:$m3: SnakePW 0x18c76:$m4: \SnakeKeylogger\
0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1770c:$x1: $%SMTPDV$ 0x17722:$x2: $#TheHashHere%& 0x18a6c:$x3: %FTPDV$ 0x18b34:$x4: $%TelegramDv$ 0x1503b:$x5: KeyLoggerEventArgs 0x153cb:$x5: KeyLoggerEventArgs 0x18adc:$m1: \| Snake Keylogger 0x18b94:$m1: \| Snake Keylogger 0x18ce8:$m1: \| Snake Keylogger 0x18e0e:$m1: \| Snake Keylogger 0x18f68:$m1: \| Snake Keylogger 0x18a90:$m2: Clipboard Logs ID 0x18c9e:$m2: Screenshot Logs ID 0x18db2:$m2: keystroke Logs ID 0x18f9e:$m3: SnakePW 0x18c76:$m4: \SnakeKeylogger\
Click to see the 51 entries

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Oct 2023 05:48:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeAge: 0Cache-Control: public,max-age=0,must-revalidateVary: Accept-EncodingX-Nf-Request-Id: 01HDZJ02AFES9CKAYD8VYCNN2CCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GMVxCTCuT03JBSoMF4Po387hkk3lt4sAHoK8j25jn%2FBrf882gb2cR1qx%2Bg7CoOS0XXFu%2FU7GA%2BZ2tm1pY0rUR8EFU0S6QOtaKfXcB6KS20eZqZ3GlaKhit%2FB2m2e"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 81e15e153ea91fd4-IADalt-svc: h3=":443"; ma=86400

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030DE000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.0000000003021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://freegeoip.app
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.000000000311D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipbase.com
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.0000000003021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.25.dr	String found in binary or memory: http://upx.sf.net
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.0000000003115000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2745588787.000000000317B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.000000000317B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030DE000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app/xml/
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app/xml/154.16.49.82
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.000000000311D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipbase.com
Source: aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030DE000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2745588787.000000000311D000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2745588787.0000000003119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipbase.com/xml/154.16.49.82

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: global traffic	HTTP traffic detected: GET /xml/154.16.49.82 HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.49.82 HTTP/1.1Host: ipbase.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: 3vj5tYFb6a.exe PID: 2640, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 3vj5tYFb6a.exe PID: 2640, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: aspnet_compiler.exe PID: 7512, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: aspnet_compiler.exe PID: 7512, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: 3vj5tYFb6a.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: 3vj5tYFb6a.exe PID: 2640, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 3vj5tYFb6a.exe PID: 2640, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: aspnet_compiler.exe PID: 7512, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: aspnet_compiler.exe PID: 7512, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7512 -s 2204

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Code function: 0_2_01130848	0_2_01130848
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Code function: 0_2_01132178	0_2_01132178
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Code function: 0_2_01130839	0_2_01130839
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Code function: 0_2_05AE54A8	0_2_05AE54A8
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Code function: 0_2_05AE5499	0_2_05AE5499
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Code function: 22_2_016A9278	22_2_016A9278
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Code function: 22_2_016A4577	22_2_016A4577
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Code function: 22_2_016A65C8	22_2_016A65C8
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Code function: 22_2_016A5FA0	22_2_016A5FA0

Source: 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQnefohbpaxqtrkoddpzy.dll" vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003C63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQnefohbpaxqtrkoddpzy.dll" vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe, 00000000.00000000.2041455926.00000000007A4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAgwo.exej% vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameiJMJnUDAnLMGBkvrphkwZ.exeL vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe, 00000000.00000002.2691462788.0000000005090000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameQnefohbpaxqtrkoddpzy.dll" vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameiJMJnUDAnLMGBkvrphkwZ.exeL vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002B2F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameiJMJnUDAnLMGBkvrphkwZ.exeL vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclrjit.dllT vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameiJMJnUDAnLMGBkvrphkwZ.exeL vs 3vj5tYFb6a.exe
Source: 3vj5tYFb6a.exe	Binary or memory string: OriginalFilenameAgwo.exej% vs 3vj5tYFb6a.exe

Source: 3vj5tYFb6a.exe	ReversingLabs: Detection: 62%
Source: 3vj5tYFb6a.exe	Virustotal: Detection: 63%

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

File read: C:\Users\user\Desktop\3vj5tYFb6a.exe

Jump to behavior

Source: 3vj5tYFb6a.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\3vj5tYFb6a.exe C:\Users\user\Desktop\3vj5tYFb6a.exe
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /release
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /renew
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7512 -s 2204
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /release	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /renew	Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe

Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

File created: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@30/24@4/3

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: 3vj5tYFb6a.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7512

Source: aspnet_compiler.exe, 00000016.00000002.2743593917.0000000001526000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb]#x

Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, eq38wbJIFbrep7POmEO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, eq38wbJIFbrep7POmEO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, eq38wbJIFbrep7POmEO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, eq38wbJIFbrep7POmEO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, eq38wbJIFbrep7POmEO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, eq38wbJIFbrep7POmEO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, eq38wbJIFbrep7POmEO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, eq38wbJIFbrep7POmEO.cs	Cryptographic APIs: 'CreateDecryptor'

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 3vj5tYFb6a.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 3vj5tYFb6a.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 3vj5tYFb6a.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\aspnet_compiler.pdb+ source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: System.ni.pdbRSDS source: WERC146.tmp.dmp.25.dr
Source:	Binary string: \??\C:\Windows\exe\aspnet_compiler.pdb source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbesW source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdbz source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdbq source: WERC146.tmp.dmp.25.dr
Source:	Binary string: @&o.pdb source: aspnet_compiler.exe, 00000016.00000002.2743267917.0000000000FE7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdb source: aspnet_compiler.exe, 00000016.00000002.2743267917.0000000000FE7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERC146.tmp.dmp.25.dr
Source:	Binary string: ,,.pdb source: aspnet_compiler.exe, 00000016.00000002.2743267917.0000000000FE7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\aspnet_compiler.pdbv source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdb* source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: o@C:\Windows\aspnet_compiler.pdb source: aspnet_compiler.exe, 00000016.00000002.2743267917.0000000000FE7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\aspnet_compiler.PDB source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: System.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbh source: aspnet_compiler.exe, 00000016.00000002.2744857661.00000000015DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: aspnet_compiler.exe, 00000016.00000002.2744857661.00000000015DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERC146.tmp.dmp.25.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: System.Core.ni.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb< source: aspnet_compiler.exe, 00000016.00000002.2743593917.0000000001526000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\aspnet_compiler.pdbpdbler.pdb source: aspnet_compiler.exe, 00000016.00000002.2744857661.00000000015DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\aspnet_compiler.pdbH source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: ?&oC:\Users\user\AppData\Local\Temp\aspnet_compiler.pdb source: aspnet_compiler.exe, 00000016.00000002.2743267917.0000000000FE7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb]#x source: aspnet_compiler.exe, 00000016.00000002.2743593917.0000000001526000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbL source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\aspnet_compiler.pdbX source: aspnet_compiler.exe, 00000016.00000002.2743267917.0000000000FE7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdbmpiler.pdbpdbler.pdbompiler.pdbu source: aspnet_compiler.exe, 00000016.00000002.2743267917.0000000000FE7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: \??\C:\Windows\aspnet_compiler.pdb* source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb\| source: WERC146.tmp.dmp.25.dr
Source:	Binary string: System.Core.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\aspnet_compiler.PDB source: aspnet_compiler.exe, 00000016.00000002.2743267917.0000000000FE7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdb source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006779000.00000004.00000020.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2743267917.0000000000FE7000.00000004.00000010.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000000.2666599950.0000000000E52000.00000002.00000001.01000000.00000007.sdmp, aspnet_compiler.exe.0.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\aspnet_compiler.pdb source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\aspnet_compiler.pdb source: aspnet_compiler.exe, 00000016.00000002.2746693055.0000000006740000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERC146.tmp.dmp.25.dr
Source:	Binary string: System.ni.pdb source: WERC146.tmp.dmp.25.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERC146.tmp.dmp.25.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, eq38wbJIFbrep7POmEO.cs	.Net Code: Type.GetTypeFromHandle(Le2jV7ixGP6fC9nKmma.uQxBWdNAFF(16777338)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(Le2jV7ixGP6fC9nKmma.uQxBWdNAFF(16777253)),Type.GetTypeFromHandle(Le2jV7ixGP6fC9nKmma.uQxBWdNAFF(16777300))})
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, eq38wbJIFbrep7POmEO.cs	.Net Code: Type.GetTypeFromHandle(Le2jV7ixGP6fC9nKmma.uQxBWdNAFF(16777338)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(Le2jV7ixGP6fC9nKmma.uQxBWdNAFF(16777253)),Type.GetTypeFromHandle(Le2jV7ixGP6fC9nKmma.uQxBWdNAFF(16777300))})
Source: 0.2.3vj5tYFb6a.exe.3be35f0.6.raw.unpack, eq38wbJIFbrep7POmEO.cs	.Net Code: Type.GetTypeFromHandle(Le2jV7ixGP6fC9nKmma.uQxBWdNAFF(16777338)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(Le2jV7ixGP6fC9nKmma.uQxBWdNAFF(16777253)),Type.GetTypeFromHandle(Le2jV7ixGP6fC9nKmma.uQxBWdNAFF(16777300))})

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Code function: 0_2_01070D80 pushfd ; retf	0_2_01070D81
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Code function: 0_2_01070CD0 pushad ; retf	0_2_01070D11
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Code function: 0_2_011359C2 push ebp; retf	0_2_011359C8
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Code function: 0_2_01135A01 push ss; retf	0_2_01135A07
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Code function: 0_2_05AE9F7B push edi; retn 0080h	0_2_05AE9F7D
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Code function: 22_2_016A2AD7 push 00000001h; iretd	22_2_016A2B70

Source: 3vj5tYFb6a.exe

Static PE information: 0xC2FC6181 [Wed Aug 30 11:58:57 2073 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 6.830640750171603
Source: initial sample	Static PE information: section name: .text entropy: 6.830640750171603

Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, eq38wbJIFbrep7POmEO.cs	High entropy of concatenated method names: 'tRDxNFg25lXMpc4XOMV', 'AFlVQNgWYUFc3vcg5kY', 'haDRGpGI3w', 'kjFuFOgLPLA2NPnkPbI', 'EjIu8mgbcEtcfxlAQ8Z', 'CogcfYg4viT4XbNbQm8', 'NJK0HP6bbE', 'E0FiS7xLUt', 'bNsiU3ROXw', 'M40iAIYai7'
Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, HN9KIJUeHH44DgKwGf5.cs	High entropy of concatenated method names: 'fkQUc2s4Qo', 'NC0UEEkLfP', 'ADAUO2gK8D', 'cJiUl5jhgU', 'xVR3csInqmPPQI64IBf', 'Wqui2LINHnPqYRnKJsi', 'jJIcy6IXEdtVeZfnBQp', 'bRZB0tI71W4mlFsYhai'
Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, oW8Qx78jXxe0ygXvhVf.cs	High entropy of concatenated method names: 'sPO8Q4ZxMV', 'Ujv81bemJu', 'Xkl8nwtVno', 'APMEjYHND2qAn2mZalC', 'dSHlNiHXWAHFXkkBbvo', 'FFO8ORwJxa', 'Tpn8la1i24', 'um18PxYd2o', 'm1n8yJyTHF', 'i4m8cGdQja'
Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, DvwIIBVkatmMZZN5yy.cs	High entropy of concatenated method names: 'GcpW9LmF4', 'PsdddZduS', 'ub2F5D2pK', 'TeIqgbZGe', 'uRWL6eBGO', 'EFxbHFtmI', 'wDQ4WeCXu', 'twDv7kmVS', 'nDLpKPtxW', 'N1Te2EED8'
Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, SVEb4x3TpIPjn5HQEJ.cs	High entropy of concatenated method names: 'ctcHXwje0', 'cNLgM1qyb', 'znfBl8Qg6', 'nZeQbSbge', 'cE81cGrjA', 'NX5nnB0Ix', 'f8DNbhys5', 'zk5XIsp59', 'xZY7T0773', 'HGBDAT3Gvp0LjbssJM4'
Source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, khSvEaANCK3T70tyssQ.cs	High entropy of concatenated method names: 'sE6ALiwEEn', 'uOkN3oI96qbAVufMUgl', 'IIHJpYI654bsYkUwYCq', 'St2A7gEZU0', 'nQ7AW2im48', 'BtvAVG3HDy', 'JxlA2NnbcT', 'JR14MoIyfjFDcp4LLkq', 'WrYe0IIDyYG1YboDlrm', 'W19mr0Ir0gAQNE0sJMG'
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, eq38wbJIFbrep7POmEO.cs	High entropy of concatenated method names: 'tRDxNFg25lXMpc4XOMV', 'AFlVQNgWYUFc3vcg5kY', 'haDRGpGI3w', 'kjFuFOgLPLA2NPnkPbI', 'EjIu8mgbcEtcfxlAQ8Z', 'CogcfYg4viT4XbNbQm8', 'NJK0HP6bbE', 'E0FiS7xLUt', 'bNsiU3ROXw', 'M40iAIYai7'
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, HN9KIJUeHH44DgKwGf5.cs	High entropy of concatenated method names: 'fkQUc2s4Qo', 'NC0UEEkLfP', 'ADAUO2gK8D', 'cJiUl5jhgU', 'xVR3csInqmPPQI64IBf', 'Wqui2LINHnPqYRnKJsi', 'jJIcy6IXEdtVeZfnBQp', 'bRZB0tI71W4mlFsYhai'
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, oW8Qx78jXxe0ygXvhVf.cs	High entropy of concatenated method names: 'sPO8Q4ZxMV', 'Ujv81bemJu', 'Xkl8nwtVno', 'APMEjYHND2qAn2mZalC', 'dSHlNiHXWAHFXkkBbvo', 'FFO8ORwJxa', 'Tpn8la1i24', 'um18PxYd2o', 'm1n8yJyTHF', 'i4m8cGdQja'
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, DvwIIBVkatmMZZN5yy.cs	High entropy of concatenated method names: 'GcpW9LmF4', 'PsdddZduS', 'ub2F5D2pK', 'TeIqgbZGe', 'uRWL6eBGO', 'EFxbHFtmI', 'wDQ4WeCXu', 'twDv7kmVS', 'nDLpKPtxW', 'N1Te2EED8'
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, SVEb4x3TpIPjn5HQEJ.cs	High entropy of concatenated method names: 'ctcHXwje0', 'cNLgM1qyb', 'znfBl8Qg6', 'nZeQbSbge', 'cE81cGrjA', 'NX5nnB0Ix', 'f8DNbhys5', 'zk5XIsp59', 'xZY7T0773', 'HGBDAT3Gvp0LjbssJM4'
Source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, khSvEaANCK3T70tyssQ.cs	High entropy of concatenated method names: 'sE6ALiwEEn', 'uOkN3oI96qbAVufMUgl', 'IIHJpYI654bsYkUwYCq', 'St2A7gEZU0', 'nQ7AW2im48', 'BtvAVG3HDy', 'JxlA2NnbcT', 'JR14MoIyfjFDcp4LLkq', 'WrYe0IIDyYG1YboDlrm', 'W19mr0Ir0gAQNE0sJMG'
Source: 0.2.3vj5tYFb6a.exe.3be35f0.6.raw.unpack, eq38wbJIFbrep7POmEO.cs	High entropy of concatenated method names: 'tRDxNFg25lXMpc4XOMV', 'AFlVQNgWYUFc3vcg5kY', 'haDRGpGI3w', 'kjFuFOgLPLA2NPnkPbI', 'EjIu8mgbcEtcfxlAQ8Z', 'CogcfYg4viT4XbNbQm8', 'NJK0HP6bbE', 'E0FiS7xLUt', 'bNsiU3ROXw', 'M40iAIYai7'
Source: 0.2.3vj5tYFb6a.exe.3be35f0.6.raw.unpack, HN9KIJUeHH44DgKwGf5.cs	High entropy of concatenated method names: 'fkQUc2s4Qo', 'NC0UEEkLfP', 'ADAUO2gK8D', 'cJiUl5jhgU', 'xVR3csInqmPPQI64IBf', 'Wqui2LINHnPqYRnKJsi', 'jJIcy6IXEdtVeZfnBQp', 'bRZB0tI71W4mlFsYhai'
Source: 0.2.3vj5tYFb6a.exe.3be35f0.6.raw.unpack, oW8Qx78jXxe0ygXvhVf.cs	High entropy of concatenated method names: 'sPO8Q4ZxMV', 'Ujv81bemJu', 'Xkl8nwtVno', 'APMEjYHND2qAn2mZalC', 'dSHlNiHXWAHFXkkBbvo', 'FFO8ORwJxa', 'Tpn8la1i24', 'um18PxYd2o', 'm1n8yJyTHF', 'i4m8cGdQja'
Source: 0.2.3vj5tYFb6a.exe.3be35f0.6.raw.unpack, DvwIIBVkatmMZZN5yy.cs	High entropy of concatenated method names: 'GcpW9LmF4', 'PsdddZduS', 'ub2F5D2pK', 'TeIqgbZGe', 'uRWL6eBGO', 'EFxbHFtmI', 'wDQ4WeCXu', 'twDv7kmVS', 'nDLpKPtxW', 'N1Te2EED8'
Source: 0.2.3vj5tYFb6a.exe.3be35f0.6.raw.unpack, SVEb4x3TpIPjn5HQEJ.cs	High entropy of concatenated method names: 'ctcHXwje0', 'cNLgM1qyb', 'znfBl8Qg6', 'nZeQbSbge', 'cE81cGrjA', 'NX5nnB0Ix', 'f8DNbhys5', 'zk5XIsp59', 'xZY7T0773', 'HGBDAT3Gvp0LjbssJM4'
Source: 0.2.3vj5tYFb6a.exe.3be35f0.6.raw.unpack, khSvEaANCK3T70tyssQ.cs	High entropy of concatenated method names: 'sE6ALiwEEn', 'uOkN3oI96qbAVufMUgl', 'IIHJpYI654bsYkUwYCq', 'St2A7gEZU0', 'nQ7AW2im48', 'BtvAVG3HDy', 'JxlA2NnbcT', 'JR14MoIyfjFDcp4LLkq', 'WrYe0IIDyYG1YboDlrm', 'W19mr0Ir0gAQNE0sJMG'

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /release

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	File created: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe			Jump to dropped file
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe			Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup			Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup			Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe			Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe TID: 5812	Thread sleep time: -33000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe TID: 4724	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184	Thread sleep count: 861 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7188	Thread sleep count: 322 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep count: 4349 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7504	Thread sleep count: 4735 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7536	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 4290 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 4994 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7684	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5560	Thread sleep count: 3492 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4332	Thread sleep count: 5878 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7172	Thread sleep time: -13835058055282155s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3116	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7720	Thread sleep count: 594 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7720	Thread sleep count: 1397 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -599449s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -599118s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 7716	Thread sleep time: -595804s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599449	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599118	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 595804	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 861	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3508	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5786	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4349	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4735	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4290
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4994
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4398
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5051
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3492
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5878
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1178	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Window / User API: threadDelayed 594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Window / User API: threadDelayed 1397	Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599449	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599118	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Thread delayed: delay time: 595804	Jump to behavior

Source: Amcache.hve.25.dr	Binary or memory string: VMware
Source: Amcache.hve.25.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.25.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.25.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.25.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.25.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.25.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.25.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.25.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.25.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.25.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.25.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: aspnet_compiler.exe, 00000016.00000002.2743593917.0000000001526000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.25.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.25.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.25.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.25.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.25.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.25.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.25.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.25.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.25.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.25.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.25.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.25.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.25.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.25.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.25.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.25.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.25.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Memory written: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Memory written: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Memory written: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Memory written: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe base: 424000	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Memory written: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe base: 108B008	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

Memory allocated: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

Memory written: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Process created: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /release	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /renew	Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Queries volume information: C:\Users\user\Desktop\3vj5tYFb6a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3vj5tYFb6a.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\3vj5tYFb6a.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.25.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.25.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.25.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.25.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2745588787.0000000003021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3vj5tYFb6a.exe PID: 2640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 7512, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3c63610.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.5090000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3b835b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3b835b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3ba35d0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3be35f0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3ba35d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3be35f0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2691462788.0000000005090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3vj5tYFb6a.exe PID: 2640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 7512, type: MEMORYSTR

Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3vj5tYFb6a.exe PID: 2640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 7512, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2745588787.0000000003021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3vj5tYFb6a.exe PID: 2640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 7512, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3c63610.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.5090000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3c63610.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.5090000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3b835b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3b835b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3ba35d0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3be35f0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3ba35d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3be35f0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2691462788.0000000005090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3cfb7f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d51ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3vj5tYFb6a.exe.3d29aa0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3vj5tYFb6a.exe PID: 2640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 7512, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	11 Registry Run Keys / Startup Folder	311 Process Injection	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	11 System Network Configuration Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Software Packing	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3vj5tYFb6a.exe	62%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
3vj5tYFb6a.exe	63%	Virustotal		Browse
3vj5tYFb6a.exe	100%	Avira	TR/Dldr.Agent.mrjvn

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe	100%	Avira	TR/Dldr.Agent.mrjvn
C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe	62%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe	63%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ipbase.com	0%	Virustotal	Browse
freegeoip.app	0%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://ipbase.com	0%	Virustotal		Browse
https://ipbase.com	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/154.16.49.82	0%	Avira URL Cloud	safe
http://ipbase.com	0%	Avira URL Cloud	safe
https://freegeoip.app	0%	Avira URL Cloud	safe
http://freegeoip.app	0%	Avira URL Cloud	safe
https://freegeoip.app	1%	Virustotal		Browse
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Avira URL Cloud	safe
https://ipbase.com/xml/154.16.49.82	0%	Avira URL Cloud	safe
https://ipbase.com	1%	Virustotal		Browse
http://freegeoip.app	0%	Virustotal		Browse
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Virustotal		Browse
https://freegeoip.app/xml/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.31.105	true	false		high
ipbase.com	104.21.28.190	true	false	0%, Virustotal, Browse	unknown
freegeoip.app	172.67.160.84	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.com	193.122.6.168	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://freegeoip.app/xml/154.16.49.82	false	Avira URL Cloud: safe	unknown
https://ipbase.com/xml/154.16.49.82	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://freegeoip.app/xml/	3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030DE000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ipbase.com	aspnet_compiler.exe, 00000016.00000002.2745588787.000000000311D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, 3vj5tYFb6a.exe, 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://freegeoip.app	aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030DE000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.25.dr	false		high
http://checkip.dyndns.org	aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030DE000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030D3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	aspnet_compiler.exe, 00000016.00000002.2745588787.0000000003021000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipbase.com	aspnet_compiler.exe, 00000016.00000002.2745588787.000000000311D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://freegeoip.app	aspnet_compiler.exe, 00000016.00000002.2745588787.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	aspnet_compiler.exe, 00000016.00000002.2745588787.0000000003115000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000016.00000002.2745588787.000000000317B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.28.190	ipbase.com	United States	13335	CLOUDFLARENETUS	false
172.67.160.84	freegeoip.app	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1334037
Start date and time:	2023-10-30 06:46:10 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	3vj5tYFb6a.exe renamed because original name is a hash value
Original Sample Name:	10243ce788b5dcbbf248058fe196f371.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@30/24@4/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 82% Number of executed functions: 60 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample based on specific behavior Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target aspnet_compiler.exe, PID 7512 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:47:02	API Interceptor	176x Sleep call for process: powershell.exe modified
06:48:00	API Interceptor	3x Sleep call for process: 3vj5tYFb6a.exe modified
06:48:06	API Interceptor	11x Sleep call for process: aspnet_compiler.exe modified
06:48:10	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.122.6.168	SecuriteInfo.com.Win32.KeyloggerX-gen.24670.4764.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	New_product.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Design.bat.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	swift.txt.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	report_for_4-October-2023.exe	Get hash	malicious	AgentTesla, Snake Keylogger	Browse	checkip.dyndns.org/
	POkxzw7w3D.exe	Get hash	malicious	AgentTesla, Snake Keylogger	Browse	checkip.dyndns.org/
	payment_confirmation.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	zipsetup_(2).exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	(13).mp4.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	sister_live_broadcast_setup.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	1106#U3010#U770b#U76f4#U64ad#U3011#U79d2#U770b#U7535#U89c6.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	WALLHACK_CRACK_Roblox_by_PREDATOR.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	43ssYWDRhs.exe	Get hash	malicious	AgentTesla, Snake Keylogger	Browse	checkip.dyndns.org/
	cpulock.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	MJSEAUC.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	HCAP1Wys0F.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Nmtdeo.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	08A347B6-6FB3-4B5E-9A49-9EC1E49DF8F1.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipbase.com	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.147.81
	bcAE21roAv.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.147.81
	VegaStealer_v1.bin.exe	Get hash	malicious	Ades Stealer, NitroStealer	Browse	75.2.60.5
	Yandex.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	75.2.60.5
	SPYGAME.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	75.2.60.5
	A6KiC17VqI.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	TwB13kUEGN.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	w5gL8sZU6z.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	k2Bg5AlSk1.exe	Get hash	malicious	MassLogger RAT, Matiex, Snake Keylogger	Browse	75.2.60.5
	vYT3XBi8du.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	CJCxcYxjhF.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	g95CmPy67V.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	nesbiPpHpN.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	M6VkStAYfV.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	2yecaxS2wK.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	058J3H4iEy.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	jINnuKt8Yz.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	XuwCD7R8y8.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	99.83.231.61
	BOI_PAYMENT_KGA_INV._GE210228C_ADVANCE_YATANDZA.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	WLIV3a3E5t.exe	Get hash	malicious	Njrat, RL STEALER, StormKitty	Browse	99.83.231.61
freegeoip.app	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.160.84
	bcAE21roAv.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.73.97
	VegaStealer_v1.bin.exe	Get hash	malicious	Ades Stealer, NitroStealer	Browse	104.21.73.97
	Yandex.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	172.67.160.84
	SPYGAME.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	104.21.73.97
	A6KiC17VqI.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	TwB13kUEGN.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	w5gL8sZU6z.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	k2Bg5AlSk1.exe	Get hash	malicious	MassLogger RAT, Matiex, Snake Keylogger	Browse	188.114.97.7
	vYT3XBi8du.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	CJCxcYxjhF.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	g95CmPy67V.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	nesbiPpHpN.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	M6VkStAYfV.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	2yecaxS2wK.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	058J3H4iEy.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	jINnuKt8Yz.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.13
	XuwCD7R8y8.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	188.114.96.7
	BOI_PAYMENT_KGA_INV._GE210228C_ADVANCE_YATANDZA.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	WLIV3a3E5t.exe	Get hash	malicious	Njrat, RL STEALER, StormKitty	Browse	188.114.97.7
www.google.com	to62eBFVj5.exe	Get hash	malicious	Amadey, Babadeda, Mystic Stealer, Raccoon Stealer v2, RedLine, SmokeLoader, Xmrig	Browse	142.251.111.94
	file.exe	Get hash	malicious	Amadey, Babadeda, Mystic Stealer, RedLine, SmokeLoader, Xmrig, zgRAT	Browse	142.251.167.106
	Setup.msi	Get hash	malicious	Unknown	Browse	172.253.115.104
	Setup.msi	Get hash	malicious	Unknown	Browse	173.194.68.104
	https://www.paypal-support.com/s/?language=en_US	Get hash	malicious	Unknown	Browse	142.251.16.104
	https://szyuanshengheng.com/Rakuten/index.php	Get hash	malicious	Unknown	Browse	172.253.62.103
	https://ktgfasudg.xyz/login.php	Get hash	malicious	Unknown	Browse	142.251.16.99
	https://app10.runmags.com/	Get hash	malicious	Unknown	Browse	172.253.115.104
	https://kuroneko-yamato-service.shop/	Get hash	malicious	Unknown	Browse	172.253.63.99
	https://pub-76f3c6b706914e5fbef629ba3dd600e5.r2.dev/emailverification.html	Get hash	malicious	HTMLPhisher	Browse	142.251.16.104
	https://pub-d474e286b25f4c1e9e78e12ca8e5c0b5.r2.dev/new.html	Get hash	malicious	HTMLPhisher	Browse	172.253.63.105
	https://cmscbsmcoenad.crpafma.cn/	Get hash	malicious	Unknown	Browse	172.253.115.147
	https://pub-bc913ad4eea644849b0a3bec6b515044.r2.dev/Authentication010.html	Get hash	malicious	HTMLPhisher	Browse	172.253.63.99
	https://wallet.cloudwalletconnect.com/	Get hash	malicious	Unknown	Browse	142.251.16.105
	https://staemcomrnunitly.ru/	Get hash	malicious	Unknown	Browse	142.251.16.99
	https://jhgktnf.com/?loginid=8d005990345bbf28d24f036f227a66d4-etc-co-jphttps://jhgktnf.com/?loginid=8d005990345bbf28d24f036f227a66d4-etc-co-jp	Get hash	malicious	Unknown	Browse	172.253.62.147
	https://www.smbcs.life/	Get hash	malicious	Unknown	Browse	172.253.63.99
	https://stearncomunitly.ru/	Get hash	malicious	Unknown	Browse	172.253.122.106
	https://co.jp.smbc.uewiwjpman.com/	Get hash	malicious	Unknown	Browse	142.251.167.106
	https://panda-marine.com/	Get hash	malicious	Unknown	Browse	142.251.16.147

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	SB0G28XC.bat.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	CI_84394.cmd.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	https://updateapponplaystore.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	193.122.128.135
	https://netflix-membership-bd.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	193.122.130.38
	https://shabdndjwinn.blogspot.com/?m=1	Get hash	malicious	HTMLPhisher	Browse	193.122.130.38
	https://watchnownetflix.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	150.136.156.92
	https://freefireenewgames.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	193.122.130.38
	https://netflixaccountloginpage.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	150.136.156.92
	https://freenetflixxaccontcom.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	150.136.25.38
	https://govtjao.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	193.122.128.135
	aILzoYwXdz.elf	Get hash	malicious	Mirai	Browse	147.154.227.187
	uM5nD8x8pc.elf	Get hash	malicious	Mirai	Browse	144.25.108.223
	https://www.google.com/url?q=https://nwp0otxd.page.link/RtQw&sa=D&source=editors&ust=1698325187920038&usg=AOvVaw0mg0cllXFrqTmYcNPBcAu6	Get hash	malicious	Unknown	Browse	150.136.25.38
	https://3h2cuxg1.page.link/naxz&sa=D&source=editors&ust=1698325144367624&usg=AOvVaw04Zt9ypPNZfaUBkeZWuoTX	Get hash	malicious	Unknown	Browse	150.136.25.38
	https://objectstorage.eu-frankfurt-1.oraclecloud.com/n/frdtal0a81zt/b/367489493903puz35647389302/o/microsoftonline.htm	Get hash	malicious	HTMLPhisher	Browse	134.70.40.1
	08A347B6-6FB3-4B5E-9A49-9EC1E49DF8F1.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	PIsazVgJR4.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Request_for_Quotation_-E23101031.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	x86.elf	Get hash	malicious	Mirai	Browse	130.61.168.172
CLOUDFLARENETUS	SInterpipeF23101016100.exe	Get hash	malicious	Azorult, GuLoader	Browse	172.67.135.37
	Setup.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	claim_video_Hotel291023.mp4.exe	Get hash	malicious	Unknown	Browse	172.67.142.121
	RlnsLbBlGs.exe	Get hash	malicious	Amadey, Babadeda, Mystic Stealer, RedLine, SmokeLoader, zgRAT	Browse	172.64.145.151
	iqkmyhUCPE.exe	Get hash	malicious	Amadey, Babadeda, Glupteba, Mystic Stealer, RedLine, SmokeLoader, zgRAT	Browse	104.21.20.155
	15gYWTX34t.exe	Get hash	malicious	Amadey, Babadeda, Glupteba, Mystic Stealer, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	104.21.20.155
	lCP5KtcDIS.exe	Get hash	malicious	Amadey, Babadeda, Glupteba, Mystic Stealer, RedLine, SmokeLoader, zgRAT	Browse	104.21.20.155
	aObYrZt59C.exe	Get hash	malicious	Amadey, Babadeda, Glupteba, Mystic Stealer, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	172.64.146.120
	https://kuroneko-yamato-service.shop/	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://pub-76f3c6b706914e5fbef629ba3dd600e5.r2.dev/emailverification.html	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35
	1ikKTZZ7De.exe	Get hash	malicious	Amadey, Babadeda, Mystic Stealer, RedLine, SmokeLoader, zgRAT	Browse	104.19.218.90
	https://pub-d474e286b25f4c1e9e78e12ca8e5c0b5.r2.dev/new.html	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35
	NWzDZBgPhA.exe	Get hash	malicious	RedLine	Browse	104.20.67.143
	NWzDZBgPhA.exe	Get hash	malicious	RedLine	Browse	104.20.67.143
	https://pub-bc913ad4eea644849b0a3bec6b515044.r2.dev/Authentication010.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://wallet.cloudwalletconnect.com/	Get hash	malicious	Unknown	Browse	104.18.35.15
	https://staemcomrnunitly.ru/	Get hash	malicious	Unknown	Browse	104.21.34.147
	https://stearncomunitly.ru/	Get hash	malicious	Unknown	Browse	104.18.42.105
	https://pub-a9679b2711464ea9917a6c5392d93ee5.r2.dev/araxn.html	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35
	https://pub-b81b5bf862c04fa5982daffd9ca70d80.r2.dev/cc23.html	Get hash	malicious	Unknown	Browse	104.18.3.35

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	r9yoXOkPES.exe	Get hash	malicious	Njrat	Browse	172.67.160.84 104.21.28.190
	61BAN1qUS5.exe	Get hash	malicious	Njrat	Browse	172.67.160.84 104.21.28.190
	file.exe	Get hash	malicious	Unknown	Browse	172.67.160.84 104.21.28.190
	Checkeur netflix validator by crips.exe	Get hash	malicious	LimeRAT	Browse	172.67.160.84 104.21.28.190
	New_Order_(2).js	Get hash	malicious	PXRECVOWEIWOEI Stealer, zgRAT	Browse	172.67.160.84 104.21.28.190
	ify.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	172.67.160.84 104.21.28.190
	lK3sh4b3ds.exe	Get hash	malicious	Agniane Stealer	Browse	172.67.160.84 104.21.28.190
	https://docs.google.com/presentation/d/1mPihsFJvaYn8yxmafo1fNbuOr1nDfR-m05559wjl-9k/pub	Get hash	malicious	Unknown	Browse	172.67.160.84 104.21.28.190
	lK3sh4b3ds.exe	Get hash	malicious	Agniane Stealer	Browse	172.67.160.84 104.21.28.190
	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.160.84 104.21.28.190
	bcAE21roAv.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.160.84 104.21.28.190
	#U043f#U0440#U043e#U0432#U0435#U0440#U0430_#U0431#U043b#U043e#U043a#U043d#U043e#U0442#U0430.scr.exe	Get hash	malicious	Unknown	Browse	172.67.160.84 104.21.28.190
	file.exe	Get hash	malicious	XFiles Stealer	Browse	172.67.160.84 104.21.28.190
	AS9Dqsivqk.exe	Get hash	malicious	Unknown	Browse	172.67.160.84 104.21.28.190
	AS9Dqsivqk.exe	Get hash	malicious	Unknown	Browse	172.67.160.84 104.21.28.190
	Invoices.scr.exe	Get hash	malicious	AveMaria	Browse	172.67.160.84 104.21.28.190
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse	172.67.160.84 104.21.28.190
	j6gr7r4Bj2.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	172.67.160.84 104.21.28.190
	ERFrKcEtfs.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	172.67.160.84 104.21.28.190
	zipsetup_(2).exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	172.67.160.84 104.21.28.190

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe	50000PCSPIC12F1501-ESN.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.KeyloggerX-gen.6339.24340.exe	Get hash	malicious	XWorm	Browse
	Jdxvyx.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.11530.1442.exe	Get hash	malicious	AgentTesla	Browse
	shipping_doc_62085317440.exe	Get hash	malicious	AgentTesla	Browse
	PRE-ALERT_IOF23-24JPR1298.exe	Get hash	malicious	AgentTesla	Browse
	TRANSF.exe	Get hash	malicious	GuLoader AgentTesla	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aspnet_compiler._671408d8f99b945fb318820b118cbaac1562996_00cd84b8_f5ae1b8c-e8f9-4fa2-8207-26e2105f9599\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.160369187200042
Encrypted:	false
SSDEEP:	192:s89ZrvNT0BU/Ka6ce36qZzuiF4Z24IO8hn2E:sq1vNABU/KarVqZzuiF4Y4IO8h
MD5:	5A720DFFA83D87FC6A91CEC9F94D9D5C
SHA1:	40B6BDADDF161C9EFBC62430B14228FF60F5BDFB
SHA-256:	6645BE835572EAD5ACC4ED671FEAD94CFCE3BD2E6A4014C5253C5796DC479E10
SHA-512:	6B72DBAF42FFE8408D63DFB12B3BD87987BC7B02FF2C467F0C8BC51C8BD68416A55CEECE5360E8AA17A32B3021704E63DC40E32F9172E3D365969AC60EBCE3AB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.3.1.1.8.4.8.7.8.5.7.0.7.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.4.3.1.1.8.4.8.8.9.1.9.5.6.6.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.a.e.1.b.8.c.-.e.8.f.9.-.4.f.a.2.-.8.2.0.7.-.2.6.e.2.1.0.5.f.9.5.9.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.e.9.f.c.f.4.5.-.0.7.9.a.-.4.e.5.2.-.b.5.0.9.-.e.d.a.d.2.0.1.6.e.4.a.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.a.s.p.n.e.t._.c.o.m.p.i.l.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.a.s.p.n.e.t._.c.o.m.p.i.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.5.8.-.0.0.0.1.-.0.0.1.4.-.9.a.7.c.-.e.1.a.5.f.4.0.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.c.1.b.e.e.9.7.6.6.0.4.c.6.f.e.9.0.9.5.d.c.0.e.8.7.f.3.b.5.2.0.0.0.0.0.0.9.0.4.!.0.0.0.0.1.9.d.f.d.8.6.2.9.4.c.4.a.5.2.5.b.a.2.1.c.6.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC146.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 30 05:48:08 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	301518
Entropy (8bit):	3.6005779934754885
Encrypted:	false
SSDEEP:	3072:wyS0QlZnVyv4kHvI4uEqZHzgHLTg5flDqhI:woQLVyQr4MTgrTg5pqe
MD5:	D1688DF6264419EBC9ACCD3E0C8DDB43
SHA1:	50CDFB14EF32E73B1B3E4A5254DB322CAD3A325A
SHA-256:	AF98375879BF51BF0417741FF41E22ED65A6FD758A26F405EE3D6D476FA338F2
SHA-512:	506FFA3F526F753F556FA451256FA05EB3815F39018BCFC4EE92C111375257981ED83A12472CD1F978DE0BB067253C1802BEB519AB16E1655A4340497D625434
Malicious:	false
Preview:	MDMP..a..... ........C?e....................................<....(.......%...^..........`.......8...........T...........PV..~C...........(...........*..............................................................................eJ......H+......GenuineIntel............T.......X....C?e.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3D8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6356
Entropy (8bit):	3.7257562765910994
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbR06L/YX4xuQE/hhCgaM4UA89bi3sfHWm:R6l7wVeJR06L/YX40HprA89bi3sfHWm
MD5:	80C0C4ABE4B0BE32909D159C758989D6
SHA1:	C67CECFD25D24C89E60421878613DCC3CD43E16E
SHA-256:	D73E6C001B3D640DE725A3B72E26D72B885E87B0A83D22ED38E3EA5901A2A069
SHA-512:	72D388C931FCF1A82864DD42AEB16B733CCEA728137FB9CE432D854A4446649423409719E31E57077F016CFC3C79ADDF3497FA3F3499414A7A3678F41F6A11A8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC417.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4699
Entropy (8bit):	4.483470157979915
Encrypted:	false
SSDEEP:	48:cvIwWl8zsIJg77aI9BuWpW8VYGvYm8M4JV4imjFD+q8bIib9ru0AyTOkDXUd:uIjfOI7bP7VdyJVaglru0AaOaXUd
MD5:	5721EE1516B52B0E86C3D7282FBB6065
SHA1:	67F21B16F372164357CE6FABAFDEF64AB7A3AC57
SHA-256:	BEA40C589CEAFBAF4830A239C7189FCAC8F1057C5671B50C2FE9D68CA47D9B64
SHA-512:	DAC8B01A3743F0C0B9C7AC6DADD478BBF9E611B04865D288B92765116ADAA0D2A3AA3DFB8A7ED6C48A3391E04529A93B3A3855596C6DA16FE261E01C4D7358B3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="38690" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3vj5tYFb6a.exe.log

Download File

Process:	C:\Users\user\Desktop\3vj5tYFb6a.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	737
Entropy (8bit):	5.352753964755418
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaWzAbDLI4MNldKZarkvoDLI4MWuCv:ML9E4KlKDE4KhKiKhBsXE4qdKqE4Ks
MD5:	0CA106C422E6449195350BCA953D7CC4
SHA1:	005E5CFB8FA6DE4708C31A1E2C1170BAA30C4340
SHA-256:	10ED25DF3CFDBE98578530971D77702C12F0D15A78135224DE1E2F19DDB9DA87
SHA-512:	AB8D82F4CD14D306B492475F9FD7714AE719AB1D09367504A28F92A1C34587700389168FD5F014BBF5B04BE37E1E13860DADD755058D2B63EA898DE388115591
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.6599547231656377
Encrypted:	false
SSDEEP:	3:Nlllulllltl:NllU
MD5:	EA2381CDF1B16E923A271DFD5EC27FFA
SHA1:	6280D95ACCAB2C9100EA14162B8A09926484AFAB
SHA-256:	C258989349BD9B905E1088F1B29CC76E240FAC0BADB2B8BE51C1DA38107FFA8E
SHA-512:	B091E838EB53F1AF9358F020909D98DA68F5A242911851880AFEA5C8085860DBBB41BFA7A3D09ABF49CE6FCE7A49FDA448A4BDFE1745A9973F649CAEA05D4083
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2d0gjoqk.sfu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2j3gfvi2.ptu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30ymwsh2.ost.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3hpsvg4t.zqq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_asve4awe.s5t.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c4zc4s5g.2ys.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dst3jkid.lw4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dt4k2am1.omo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hbzqjbhw.1m1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jda35eby.0g1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ledf2yjj.hfz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wvyqpifo.tiy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z0bzxzd5.pye.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmjs33gj.uio.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe

Download File

Process:	C:\Users\user\Desktop\3vj5tYFb6a.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	56368
Entropy (8bit):	6.120994357619221
Encrypted:	false
SSDEEP:	768:fF9E8FLLs2Zokf85d9PTV6Iq8Fnqf7P+WxqWKnz8DH:ffE6EkfOd9PT86dWvKgb
MD5:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
SHA1:	19DFD86294C4A525BA21C6AF77681B2A9BBECB55
SHA-256:	99A2C778C9A6486639D0AFF1A7D2D494C2B0DC4C7913EBCB7BFEA50A2F1D0B09
SHA-512:	94F0ACE37CAE77BE9935CF4FC8AAA94691343D3B38DE5E16C663B902C220BFF513CD02256C7AF2D815A23DD30439582DDBB0880009C76BBF36FF8FBC1A6DDC18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 50000PCSPIC12F1501-ESN.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.KeyloggerX-gen.6339.24340.exe, Detection: malicious, Browse Filename: Jdxvyx.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.TrojanX-gen.11530.1442.exe, Detection: malicious, Browse Filename: shipping_doc_62085317440.exe, Detection: malicious, Browse Filename: PRE-ALERT_IOF23-24JPR1298.exe, Detection: malicious, Browse Filename: TRANSF.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A>.]..............0................. ........@.. ....................................`.................................t...O.......................0B..........<................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......t3..pc.............X...<........................................0..........s.....Y.....(.....Z.....&..(......+....(....o......r...p(....-..r...p(....,.....X....i2..-;(....(..........%.r!..p.(....(....((...(....(....(....( .....-.(7...(......(....-...~S...-.~R....S...s!.....~W...o"....~U...o#....~V...o$....o%...~Y...o&...~S...~Q...~T....s'....P...~P...sE...o(............~W....@_,s.....()...r7..p.$(*........o+..........o,....2....... ....37(....(8.........%...o-....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe

Download File

Process:	C:\Users\user\Desktop\3vj5tYFb6a.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	510464
Entropy (8bit):	5.999553408269374
Encrypted:	false
SSDEEP:	12288:nicNb5chlOMdRL8m6alMG/njrPIRp4tbhknaSJ8XC0x:tqhPRL8m6alMG/njrPIRp496aLXC0
MD5:	10243CE788B5DCBBF248058FE196F371
SHA1:	0DA95887908B6ADA23C698DE6CF2F3F986655721
SHA-256:	8BF51CCB2646D38AF6778A0712C78415E113B1393509AFDC16C97A0BFB91EB55
SHA-512:	A990028F8A9B4CCE76C2409F95837436D61DC7038D1365D669FD9143F75580E74E4F9F013934435A1CA9E0C1360BBEBFE276EA4328AB9D7BD26C6C7C63E83160
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 62% Antivirus: Virustotal, Detection: 63%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a................0..............+... ...@....@.. ....................... ............@..................................+..O....@...............................+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc..............................@..B.................+......H........$...............:...............................................0..2.........i..1.r...ps....z(....o.....(....&s....%.o....%o....%.o....o....o....(....r...ps.....r...p.o....(....(....r...p.o....(....(....r...p.o....(....(....r...p.o....(....(....r...p.o....(....(....r*..p.o ...."...(!...(....rN..p.o"....#...(!...(....rt..p.o#....#...(!...(....r...p.o$....#...(!...(....r...p.o%....#...(!...(....r...p.o&....#...(!...(....r...p.o'...(....(....r...p.o(...(....(....r"..p.o

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\3vj5tYFb6a.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.42215784083635
Encrypted:	false
SSDEEP:	6144:5Svfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNb0uhiTw:wvloTMW+EZMM6DFyJ03w
MD5:	B26DFD2536D15A1C869F90B632F04117
SHA1:	02BB2740A787C92EFAEEC302F4F6D8092AE8A7EF
SHA-256:	33BB379463CF02FEFB290D7960F80A3BF44B625DC1BAE7C52DBB779A7496C63F
SHA-512:	C3B26AF79ACBB5DF2E0DA10D4F11D6F3F786A35EC6E7DB8B7D4A74C94C4C13F921039AF7145210E3570E5237B65C71074DF53AEA0C859C4D4B509C1F18682DA3
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.`..................................................................................................................................................................................................................................................................................................................................................D...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.999553408269374
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	3vj5tYFb6a.exe
File size:	510'464 bytes
MD5:	10243ce788b5dcbbf248058fe196f371
SHA1:	0da95887908b6ada23c698de6cf2f3f986655721
SHA256:	8bf51ccb2646d38af6778a0712c78415e113b1393509afdc16c97a0bfb91eb55
SHA512:	a990028f8a9b4cce76c2409f95837436d61dc7038d1365d669fd9143f75580e74e4f9f013934435a1ca9e0c1360bbebfe276ea4328ab9d7bd26c6c7c63e83160
SSDEEP:	12288:nicNb5chlOMdRL8m6alMG/njrPIRp4tbhknaSJ8XC0x:tqhPRL8m6alMG/njrPIRp496aLXC0
TLSH:	8CB42915E3027505D8FCAB728FBFE7F02250ABAF5A614206BD8435FA44E939D25C3AC5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a................0..............+... ...@....@.. ....................... ............@................................

File Icon


Icon Hash:	9a2c56c33b3d3b17

Static PE Info

General

Entrypoint:	0x452bfa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC2FC6181 [Wed Aug 30 11:58:57 2073 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x52ba8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x54000	0x2b8ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x52b8c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x50c00	0x50c00	False	0.6503996952399381	data	6.830640750171603	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x54000	0x2b8ac	0x2ba00	False	0.18921248209169053	data	3.7443496131971172	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x54200	0x35ba	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9911298531336339
RT_ICON	0x577cc	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.07398260972435822
RT_ICON	0x68004	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.11488332982972461
RT_ICON	0x714bc	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.13313308687615527
RT_ICON	0x76954	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.14684695323571093
RT_ICON	0x7ab8c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.21286307053941908
RT_ICON	0x7d144	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.2840056285178236
RT_ICON	0x7e1fc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.3704918032786885
RT_ICON	0x7eb94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.46099290780141844
RT_GROUP_ICON	0x7f00c	0x84	data	0.7272727272727273
RT_VERSION	0x7f0a0	0x406	data	0.41067961165048544
RT_MANIFEST	0x7f4b8	0x3ed	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.4218905472636816

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2023 06:48:05.625711918 CET	49720	80	192.168.2.5	193.122.6.168
Oct 30, 2023 06:48:05.808574915 CET	80	49720	193.122.6.168	192.168.2.5
Oct 30, 2023 06:48:05.808820009 CET	49720	80	192.168.2.5	193.122.6.168
Oct 30, 2023 06:48:06.354547024 CET	49720	80	192.168.2.5	193.122.6.168
Oct 30, 2023 06:48:06.537195921 CET	80	49720	193.122.6.168	192.168.2.5
Oct 30, 2023 06:48:06.538450956 CET	80	49720	193.122.6.168	192.168.2.5
Oct 30, 2023 06:48:06.583539963 CET	49720	80	192.168.2.5	193.122.6.168
Oct 30, 2023 06:48:06.767543077 CET	80	49720	193.122.6.168	192.168.2.5
Oct 30, 2023 06:48:06.811830997 CET	49720	80	192.168.2.5	193.122.6.168
Oct 30, 2023 06:48:06.965630054 CET	49721	443	192.168.2.5	172.67.160.84
Oct 30, 2023 06:48:06.965692997 CET	443	49721	172.67.160.84	192.168.2.5
Oct 30, 2023 06:48:06.965755939 CET	49721	443	192.168.2.5	172.67.160.84
Oct 30, 2023 06:48:06.974478006 CET	49721	443	192.168.2.5	172.67.160.84
Oct 30, 2023 06:48:06.974497080 CET	443	49721	172.67.160.84	192.168.2.5
Oct 30, 2023 06:48:07.181688070 CET	443	49721	172.67.160.84	192.168.2.5
Oct 30, 2023 06:48:07.181874990 CET	49721	443	192.168.2.5	172.67.160.84
Oct 30, 2023 06:48:07.183561087 CET	49721	443	192.168.2.5	172.67.160.84
Oct 30, 2023 06:48:07.183592081 CET	443	49721	172.67.160.84	192.168.2.5
Oct 30, 2023 06:48:07.184062004 CET	443	49721	172.67.160.84	192.168.2.5
Oct 30, 2023 06:48:07.233652115 CET	49721	443	192.168.2.5	172.67.160.84
Oct 30, 2023 06:48:07.279541016 CET	49721	443	192.168.2.5	172.67.160.84
Oct 30, 2023 06:48:07.322475910 CET	443	49721	172.67.160.84	192.168.2.5
Oct 30, 2023 06:48:07.404130936 CET	443	49721	172.67.160.84	192.168.2.5
Oct 30, 2023 06:48:07.404356956 CET	443	49721	172.67.160.84	192.168.2.5
Oct 30, 2023 06:48:07.404433966 CET	49721	443	192.168.2.5	172.67.160.84
Oct 30, 2023 06:48:07.411473989 CET	49721	443	192.168.2.5	172.67.160.84
Oct 30, 2023 06:48:07.511800051 CET	49722	443	192.168.2.5	104.21.28.190
Oct 30, 2023 06:48:07.511842012 CET	443	49722	104.21.28.190	192.168.2.5
Oct 30, 2023 06:48:07.511941910 CET	49722	443	192.168.2.5	104.21.28.190
Oct 30, 2023 06:48:07.512571096 CET	49722	443	192.168.2.5	104.21.28.190
Oct 30, 2023 06:48:07.512588978 CET	443	49722	104.21.28.190	192.168.2.5
Oct 30, 2023 06:48:07.720133066 CET	443	49722	104.21.28.190	192.168.2.5
Oct 30, 2023 06:48:07.720432043 CET	49722	443	192.168.2.5	104.21.28.190
Oct 30, 2023 06:48:07.722968102 CET	49722	443	192.168.2.5	104.21.28.190
Oct 30, 2023 06:48:07.722979069 CET	443	49722	104.21.28.190	192.168.2.5
Oct 30, 2023 06:48:07.723436117 CET	443	49722	104.21.28.190	192.168.2.5
Oct 30, 2023 06:48:07.725589037 CET	49722	443	192.168.2.5	104.21.28.190
Oct 30, 2023 06:48:07.766482115 CET	443	49722	104.21.28.190	192.168.2.5
Oct 30, 2023 06:48:07.974850893 CET	443	49722	104.21.28.190	192.168.2.5
Oct 30, 2023 06:48:07.974929094 CET	443	49722	104.21.28.190	192.168.2.5
Oct 30, 2023 06:48:07.974967957 CET	443	49722	104.21.28.190	192.168.2.5
Oct 30, 2023 06:48:07.975070953 CET	443	49722	104.21.28.190	192.168.2.5
Oct 30, 2023 06:48:07.975121975 CET	49722	443	192.168.2.5	104.21.28.190
Oct 30, 2023 06:48:07.975121975 CET	49722	443	192.168.2.5	104.21.28.190
Oct 30, 2023 06:48:07.980674982 CET	49722	443	192.168.2.5	104.21.28.190
Oct 30, 2023 06:48:12.072031975 CET	49720	80	192.168.2.5	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2023 06:47:03.807622910 CET	54649	53	192.168.2.5	1.1.1.1
Oct 30, 2023 06:47:03.901319027 CET	53	54649	1.1.1.1	192.168.2.5
Oct 30, 2023 06:48:04.864658117 CET	52040	53	192.168.2.5	1.1.1.1
Oct 30, 2023 06:48:04.958959103 CET	53	52040	1.1.1.1	192.168.2.5
Oct 30, 2023 06:48:06.828947067 CET	53179	53	192.168.2.5	1.1.1.1
Oct 30, 2023 06:48:06.964550018 CET	53	53179	1.1.1.1	192.168.2.5
Oct 30, 2023 06:48:07.414632082 CET	56155	53	192.168.2.5	1.1.1.1
Oct 30, 2023 06:48:07.510363102 CET	53	56155	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2023 06:47:03.807622910 CET	192.168.2.5	1.1.1.1	0x3fd5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:04.864658117 CET	192.168.2.5	1.1.1.1	0xa02c	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:06.828947067 CET	192.168.2.5	1.1.1.1	0xd8d3	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:07.414632082 CET	192.168.2.5	1.1.1.1	0x6004	Standard query (0)	ipbase.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2023 06:47:03.901319027 CET	1.1.1.1	192.168.2.5	0x3fd5	No error (0)	www.google.com		142.250.31.105	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:47:03.901319027 CET	1.1.1.1	192.168.2.5	0x3fd5	No error (0)	www.google.com		142.250.31.103	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:47:03.901319027 CET	1.1.1.1	192.168.2.5	0x3fd5	No error (0)	www.google.com		142.250.31.147	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:47:03.901319027 CET	1.1.1.1	192.168.2.5	0x3fd5	No error (0)	www.google.com		142.250.31.99	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:47:03.901319027 CET	1.1.1.1	192.168.2.5	0x3fd5	No error (0)	www.google.com		142.250.31.104	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:47:03.901319027 CET	1.1.1.1	192.168.2.5	0x3fd5	No error (0)	www.google.com		142.250.31.106	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:04.958959103 CET	1.1.1.1	192.168.2.5	0xa02c	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2023 06:48:04.958959103 CET	1.1.1.1	192.168.2.5	0xa02c	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:04.958959103 CET	1.1.1.1	192.168.2.5	0xa02c	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:04.958959103 CET	1.1.1.1	192.168.2.5	0xa02c	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:04.958959103 CET	1.1.1.1	192.168.2.5	0xa02c	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:04.958959103 CET	1.1.1.1	192.168.2.5	0xa02c	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:06.964550018 CET	1.1.1.1	192.168.2.5	0xd8d3	No error (0)	freegeoip.app		172.67.160.84	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:06.964550018 CET	1.1.1.1	192.168.2.5	0xd8d3	No error (0)	freegeoip.app		104.21.73.97	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:07.510363102 CET	1.1.1.1	192.168.2.5	0x6004	No error (0)	ipbase.com		104.21.28.190	A (IP address)	IN (0x0001)	false
Oct 30, 2023 06:48:07.510363102 CET	1.1.1.1	192.168.2.5	0x6004	No error (0)	ipbase.com		172.67.147.81	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

freegeoip.app

ipbase.com

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49721	172.67.160.84	443	C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49722	104.21.28.190	443	C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49720	193.122.6.168	80	C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2023 06:48:06.354547024 CET	80	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2023 06:48:06.538450956 CET	80	IN	HTTP/1.1 200 OK Date: Mon, 30 Oct 2023 05:48:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 34 39 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.49.82</body></html>
Oct 30, 2023 06:48:06.583539963 CET	80	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 30, 2023 06:48:06.767543077 CET	81	IN	HTTP/1.1 200 OK Date: Mon, 30 Oct 2023 05:48:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 34 39 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.49.82</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49721	172.67.160.84	443	C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe

Timestamp	Direction	Data
2023-10-30 05:48:07 UTC	OUT	GET /xml/154.16.49.82 HTTP/1.1 Host: freegeoip.app Connection: Keep-Alive
2023-10-30 05:48:07 UTC	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Oct 2023 05:48:07 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Mon, 30 Oct 2023 06:48:07 GMT Location: https://ipbase.com/xml/154.16.49.82 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BvG35qdb0diwGSGAvS0M9W0Jd9fZ0gSiiQCnCyYrfm3llWcl%2BpkkjdZajKdDIO7Wb8XrpHZRhAT%2FsuOVqyQ0qbgfLKlaX7YTrxz2V2uufdzvH3F7WQz5mJLYPXKdOBOj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81e15e11d9a2573a-IAD alt-svc: h3=":443"; ma=86400
2023-10-30 05:48:07 UTC	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49722	104.21.28.190	443	C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-30 05:48:07 UTC	0	OUT	GET /xml/154.16.49.82 HTTP/1.1 Host: ipbase.com Connection: Keep-Alive
2023-10-30 05:48:07 UTC	0	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Oct 2023 05:48:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Age: 0 Cache-Control: public,max-age=0,must-revalidate Vary: Accept-Encoding X-Nf-Request-Id: 01HDZJ02AFES9CKAYD8VYCNN2C CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GMVxCTCuT03JBSoMF4Po387hkk3lt4sAHoK8j25jn%2FBrf882gb2cR1qx%2Bg7CoOS0XXFu%2FU7GA%2BZ2tm1pY0rUR8EFU0S6QOtaKfXcB6KS20eZqZ3GlaKhit%2FB2m2e"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81e15e153ea91fd4-IAD alt-svc: h3=":443"; ma=86400
2023-10-30 05:48:07 UTC	1	IN	Data Raw: 63 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d Data Ascii: c0a<!DOCTYPE html><html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"> <title>Page Not Found</title> <link href='https://fonts.googleapis.com
2023-10-30 05:48:07 UTC	2	IN	Data Raw: 30 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 32 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 6d 61 69 6e 20 7b 0a 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 76 77 3b 0a 20 20 20 20 7d 0a 0a 20 20 Data Ascii: 0; font-size: 22px; line-height: 24px; } .main { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; height: 100vh; width: 100vw; }
2023-10-30 05:48:07 UTC	3	IN	Data Raw: 33 36 2c 34 2e 30 39 33 37 30 38 30 33 20 4c 38 2e 35 35 38 30 39 35 31 37 2c 37 2e 34 33 32 39 34 39 35 33 20 43 38 2e 32 33 35 33 31 34 35 39 2c 37 2e 37 34 36 31 31 32 39 38 20 38 2e 32 33 35 33 31 34 35 39 2c 38 2e 32 35 33 38 38 37 33 36 20 38 2e 35 35 38 30 39 35 31 37 2c 38 2e 35 36 36 39 33 37 36 39 20 4c 31 32 2c 31 31 2e 39 30 36 32 39 32 31 20 4c 39 2e 38 34 31 38 37 38 37 31 2c 31 34 20 4c 34 2e 32 34 32 30 38 35 34 34 2c 38 2e 35 36 36 39 33 37 35 31 20 43 33 2e 39 31 39 33 30 34 38 35 2c 38 2e 32 35 33 38 38 37 31 39 20 33 2e 39 31 39 33 30 34 38 35 2c 37 2e 37 34 36 31 31 32 38 31 20 34 2e 32 34 32 30 38 35 34 34 2c 37 2e 34 33 32 39 34 39 33 36 20 4c 39 2e 38 34 31 39 39 35 33 31 2c 32 20 4c 31 31 2e 39 39 39 38 38 33 36 2c 34 2e 30 39 33 Data Ascii: 36,4.09370803 L8.55809517,7.43294953 C8.23531459,7.74611298 8.23531459,8.25388736 8.55809517,8.56693769 L12,11.9062921 L9.84187871,14 L4.24208544,8.56693751 C3.91930485,8.25388719 3.91930485,7.74611281 4.24208544,7.43294936 L9.84199531,2 L11.9998836,4.093
2023-10-30 05:48:07 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:47:00
Start date:	30/10/2023
Path:	C:\Users\user\Desktop\3vj5tYFb6a.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\3vj5tYFb6a.exe
Imagebase:	0x750000
File size:	510'464 bytes
MD5 hash:	10243CE788B5DCBBF248058FE196F371
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 00000000.00000002.2691462788.0000000005090000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2690950066.0000000003D51000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2690950066.0000000003CB6000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2690458714.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:47:00
Start date:	30/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:47:01
Start date:	30/10/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:47:01
Start date:	30/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:47:01
Start date:	30/10/2023
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\ipconfig.exe" /release
Imagebase:	0x9b0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:47:01
Start date:	30/10/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:47:01
Start date:	30/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:47:06
Start date:	30/10/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:47:06
Start date:	30/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:47:11
Start date:	30/10/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 7572, Parent PID: 7564

General

Target ID:	11
Start time:	06:47:11
Start date:	30/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:47:17
Start date:	30/10/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 7772, Parent PID: 7764

General

Target ID:	13
Start time:	06:47:17
Start date:	30/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:47:22
Start date:	30/10/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	true

Analysis Process: conhost.exePID: 8152, Parent PID: 8144

General

Target ID:	17
Start time:	06:47:22
Start date:	30/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:47:26
Start date:	30/10/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:47:26
Start date:	30/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:47:27
Start date:	30/10/2023
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\ipconfig.exe" /renew
Imagebase:	0x9b0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:48:03
Start date:	30/10/2023
Path:	C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe
Imagebase:	0xe50000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000016.00000002.2743161051.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000016.00000002.2745588787.0000000003021000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:48:07
Start date:	30/10/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7512 -s 2204
Imagebase:	0x8d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	82
Total number of Limit Nodes:	2

Executed Functions

Function 01130848 Relevance: 1.7, Strings: 1, Instructions: 417
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D@, xrefs: 01130D25

Memory Dump Source

Source File: 00000000.00000002.2690125520.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1130000_3vj5tYFb6a.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: fd83748dfd59b1361becbd830d8100fef1a6809610857a6be9e010c9cefd3e99
Instruction ID: 94baa0f61310a88ee04964fd83b0820a1f7f457201c999db80cd0ef4a4c54d63
Opcode Fuzzy Hash: fd83748dfd59b1361becbd830d8100fef1a6809610857a6be9e010c9cefd3e99
Instruction Fuzzy Hash: 2CF19431B003558FCF48FBB4C85466E77E2AFC9700B15C969E40AAB265EF35AD55CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01130839 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690125520.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1130000_3vj5tYFb6a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 512ad11addc5702fc692137b53b50ad8dccdb3dd23629bc6f497c83e8e66da4d
Instruction ID: da74e7530c8657eecb902f1758203e0d8333d63b4229b62892b6a3e71b99f940
Opcode Fuzzy Hash: 512ad11addc5702fc692137b53b50ad8dccdb3dd23629bc6f497c83e8e66da4d
Instruction Fuzzy Hash: D4D19231B103559FCF48BBB4885866E77A2AFC8700715C968E40AAF265EF35ED56CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0113FBB0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0113FDE6

Memory Dump Source

Source File: 00000000.00000002.2690125520.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1130000_3vj5tYFb6a.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2f4b8fcdb8f241db58ae5282319d58c5bdce3f063584bb5a60b2bd09cfd24ac3
Instruction ID: fe449ccc3a35b56bf25af84153fd6d15cad83604b879429ea6a69a9dec686653
Opcode Fuzzy Hash: 2f4b8fcdb8f241db58ae5282319d58c5bdce3f063584bb5a60b2bd09cfd24ac3
Instruction Fuzzy Hash: EF917171D0021ACFEF15CF68C941BDDBBB2BF88710F148569E818A7294DB749986CF92

Uniqueness

Uniqueness Score: -1.00%

Function 010709BC Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleBaseNameA.KERNEL32(?,?,?,?), ref: 01070AC1

Memory Dump Source

Source File: 00000000.00000002.2689937387.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_3vj5tYFb6a.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: 70b21fb43e4b7a2f1e184b4af33aa2730e6fef77d9b844bf2425299099a1f4be
Instruction ID: 62fc355a8972ce7959681c6ddeb145a6e43514a653e46283270bb6b3b13b9e54
Opcode Fuzzy Hash: 70b21fb43e4b7a2f1e184b4af33aa2730e6fef77d9b844bf2425299099a1f4be
Instruction Fuzzy Hash: A9415670D00348DFDB18DFA9C894BAEBBF1BF49314F148269E859AB255D774A840CF94

Uniqueness

Uniqueness Score: -1.00%

Function 010709C0 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleBaseNameA.KERNEL32(?,?,?,?), ref: 01070AC1

Memory Dump Source

Source File: 00000000.00000002.2689937387.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_3vj5tYFb6a.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: c23cc217d4036ad0d0cfe2fd5f1415a942c05245749fed9c63606f40f1fd9da1
Instruction ID: 9351f6fd97ed73d527b67c3caa927be47afba648a372c70e856946abe2987f6b
Opcode Fuzzy Hash: c23cc217d4036ad0d0cfe2fd5f1415a942c05245749fed9c63606f40f1fd9da1
Instruction Fuzzy Hash: 8E417470D002089FDB18DFA9C884B9EBBF1BF49314F148269E859AB358C774A880CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0113F750 Relevance: 1.6, APIs: 1, Instructions: 93
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000001), ref: 0113F81E

Memory Dump Source

Source File: 00000000.00000002.2690125520.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1130000_3vj5tYFb6a.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d6e7ef53084dbec1360490ce38d5c77bc09b9265286c2c581d7f520a2fb3b8a8
Instruction ID: e8bf04b5d81a29c80b1ca5d07fe9811b7d76e36e1eb8c554f1a95c5e68ecf9ea
Opcode Fuzzy Hash: d6e7ef53084dbec1360490ce38d5c77bc09b9265286c2c581d7f520a2fb3b8a8
Instruction Fuzzy Hash: C831CC70D043499FCB14DFA9C841BAEBFF4EF89310F10806AD409EB251DB389946CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05AEB010 Relevance: 1.6, APIs: 1, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNELBASE(?,00000000,?), ref: 05AEB0A9

Memory Dump Source

Source File: 00000000.00000002.2692306373.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ae0000_3vj5tYFb6a.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 8c58b2c1512b7dea5ff49e3fe47b41ea4ed382f18e91677d59afe98f352a4635
Instruction ID: 592d0fd49fc8b9bb3b51eae24680812ed1dde351629c0e7798b7d5e4bbd359c3
Opcode Fuzzy Hash: 8c58b2c1512b7dea5ff49e3fe47b41ea4ed382f18e91677d59afe98f352a4635
Instruction Fuzzy Hash: 0F2128B1C012199FCB10CF9AD584BEEFBF5FF48310F14816AE818A7245D739AA44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0113F9C0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0113FA50

Memory Dump Source

Source File: 00000000.00000002.2690125520.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1130000_3vj5tYFb6a.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a8d0101dbfe29fea7cdb4d521b0738e25b8dff3793ad0fe86c9dd8f27caaedf7
Instruction ID: bb2ca8eb5305bc2bd235b830a44705fc059ed59ee4d9cf5552529c304e0c4a09
Opcode Fuzzy Hash: a8d0101dbfe29fea7cdb4d521b0738e25b8dff3793ad0fe86c9dd8f27caaedf7
Instruction Fuzzy Hash: 2B2148B1D003099FDB10CFA9C885BEEBBF5FF48310F108429E518A7240C778A545CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01071000 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumChildWindows.USER32(?,00000000,?), ref: 01071080

Memory Dump Source

Source File: 00000000.00000002.2689937387.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_3vj5tYFb6a.jbxd

Similarity

API ID: ChildEnumWindows
String ID:
API String ID: 3555792229-0
Opcode ID: 2e40f9420456b388fb44a1de612033024bcdb2dff5caf36ddfef714276f8925b
Instruction ID: ac29f138b6f85c2a9b911d5c7f7d10dc0bd015e49dc1a75655046ebc7bad9148
Opcode Fuzzy Hash: 2e40f9420456b388fb44a1de612033024bcdb2dff5caf36ddfef714276f8925b
Instruction Fuzzy Hash: BB2139B1D002498FDB14CFAAC944BEEFBF5EF48310F14846AE458A7290C779A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01070358 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcesses.KERNEL32(00000000,?,?), ref: 010703E3

Memory Dump Source

Source File: 00000000.00000002.2689937387.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_3vj5tYFb6a.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: a3e490c820426677f5982add2425e45181e1595df212f6e218165e26abfa85e4
Instruction ID: bac63b26870b3779e33ecbb2fdb5fa53dd88933d38de579ed337e62e47baa0ed
Opcode Fuzzy Hash: a3e490c820426677f5982add2425e45181e1595df212f6e218165e26abfa85e4
Instruction Fuzzy Hash: D221E2B1D012199FDB00CF99D985BEEFBF8FB49310F10826AE508A7241D778A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01070360 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcesses.KERNEL32(00000000,?,?), ref: 010703E3

Memory Dump Source

Source File: 00000000.00000002.2689937387.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_3vj5tYFb6a.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 9ca1b3d87555440ceafa277f53e292c0f7ea3dd84b15ce50a96c5d5dcaf67ca5
Instruction ID: caed70365c1b69914341492ebcce347d6029c1def92d9f793c9fa794a6078614
Opcode Fuzzy Hash: 9ca1b3d87555440ceafa277f53e292c0f7ea3dd84b15ce50a96c5d5dcaf67ca5
Instruction Fuzzy Hash: 482104B1D012199FDB00CF9AD885BDEFBF8FB49310F10826AE508A3340D778A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01070880 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcessModules.KERNEL32(?,?,?,?), ref: 010708FB

Memory Dump Source

Source File: 00000000.00000002.2689937387.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_3vj5tYFb6a.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: b4cd2d1f839d3e0fd7d7c96acb34e0ea25aa4164efaf788a1702eab28cfe9a01
Instruction ID: 0d910ba01acab4361bdd4a417b1006b5ee09971c79060e2310a1dafa67d33056
Opcode Fuzzy Hash: b4cd2d1f839d3e0fd7d7c96acb34e0ea25aa4164efaf788a1702eab28cfe9a01
Instruction Fuzzy Hash: DD2115B2D002499FCB10DF9AC484BDEBBF5EF49310F10846AE958A7251D778A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01071008 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumChildWindows.USER32(?,00000000,?), ref: 01071080

Memory Dump Source

Source File: 00000000.00000002.2689937387.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_3vj5tYFb6a.jbxd

Similarity

API ID: ChildEnumWindows
String ID:
API String ID: 3555792229-0
Opcode ID: 4d938b0f46cbfac303987e74a6056f3121cd9dade7c75b9cc994524ad671cc53
Instruction ID: fa24db219a490a19d1e778f8ebfa7c577273b47a538c3c8d5f8acc7f784c46b9
Opcode Fuzzy Hash: 4d938b0f46cbfac303987e74a6056f3121cd9dade7c75b9cc994524ad671cc53
Instruction Fuzzy Hash: CB212C71D002498FDB14CF9AC944BEEFBF5EF48310F148429E558A3290C779A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01070888 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,?,?,?), ref: 010708FB

Memory Dump Source

Source File: 00000000.00000002.2689937387.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_3vj5tYFb6a.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: a3a86be2522de6eb8853d6d0bd49d49e611bd239a4f6005e48fd97f8b17779d5
Instruction ID: 183505498b6f3bac70f61fac435741b433b075a6cd57cc8f2cf011e3763db639
Opcode Fuzzy Hash: a3a86be2522de6eb8853d6d0bd49d49e611bd239a4f6005e48fd97f8b17779d5
Instruction Fuzzy Hash: 9D21F2B6D002499FCB10DF9AC584BDEBBF5EF48320F108429E958A7250D778AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0113A3D8 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0113A44C

Memory Dump Source

Source File: 00000000.00000002.2690125520.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1130000_3vj5tYFb6a.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d3868d03cf68b6f0b390142d0db5d697c225f66be33d1751c665923dc3c63028
Instruction ID: 55452c1b112ee6cd043d1bb4a89f46a0c504e22d378e31a736bd1f8745326a76
Opcode Fuzzy Hash: d3868d03cf68b6f0b390142d0db5d697c225f66be33d1751c665923dc3c63028
Instruction Fuzzy Hash: E11127B1D002089FDB14DFAAC844AAEFBF4EF48320F148419D419A7250C778A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0113F8E0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0113F94E

Memory Dump Source

Source File: 00000000.00000002.2690125520.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1130000_3vj5tYFb6a.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1ccd7d3d76163b26fa122f9200f1e937491426a1fdce1320438e34ede41c9c13
Instruction ID: f0e656a4d7d35d7ea4dfd533e66e001b840e68128d633534450345bf18b88469
Opcode Fuzzy Hash: 1ccd7d3d76163b26fa122f9200f1e937491426a1fdce1320438e34ede41c9c13
Instruction Fuzzy Hash: E61126718002499FDB14DFAAC945AEFBFF5EF88320F108419E519A7250CB79A544CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0113A5A8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0113A60A

Memory Dump Source

Source File: 00000000.00000002.2690125520.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1130000_3vj5tYFb6a.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2f01d2085761955ebfbc8cd0feb390c66d8334b2e60bf239e717454c63eeaa6e
Instruction ID: 7378d5e264b2c30db5e312308d30d45054fe121f1c0c241c8e3031701a6b75e3
Opcode Fuzzy Hash: 2f01d2085761955ebfbc8cd0feb390c66d8334b2e60bf239e717454c63eeaa6e
Instruction Fuzzy Hash: 0A1136B1D002488FDB24DFAAD5457AFFBF5EF88320F208419D559A7240CB79A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD0F0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2675088955.0000000000ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ecd000_3vj5tYFb6a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75631cfd61a758750dc64494d0fc6846cdf64877b9bc5fc799243c562b90f29c
Instruction ID: bafc714d31f0ed846f1e78ccf5cb54d56f933dcf61cc4424f8bf3fba59b1764a
Opcode Fuzzy Hash: 75631cfd61a758750dc64494d0fc6846cdf64877b9bc5fc799243c562b90f29c
Instruction Fuzzy Hash: A321C3B16492449FDB04DF14DE80F2ABBA5FB94728F28C57DD8095B251C33BD847C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD0EB Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2675088955.0000000000ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ecd000_3vj5tYFb6a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60d13eede1d90ee772a828cada2728786931f3453aff5888d83412b0df648b6
Instruction ID: 219307c6c61b3f58bbf79ce18520e34e6f63300db1a65e2c5edd2cc62da254a4
Opcode Fuzzy Hash: f60d13eede1d90ee772a828cada2728786931f3453aff5888d83412b0df648b6
Instruction Fuzzy Hash: 6F11C471509280DFD701DF14DA84B15FB61FB94318F28C6AED8495B652C33BD80BCB52

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01132178 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

4'jq, xrefs: 0113221C

Memory Dump Source

Source File: 00000000.00000002.2690125520.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1130000_3vj5tYFb6a.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 6f8d6366a2f4bbe03de40189fe3f00e3db956f30a866b58dcf781a70856917c8
Instruction ID: 54b9d25bb42d8022c9286e97bebfdcea62d61a50d3d0bc3e10dbcc29ba356e97
Opcode Fuzzy Hash: 6f8d6366a2f4bbe03de40189fe3f00e3db956f30a866b58dcf781a70856917c8
Instruction Fuzzy Hash: EF611570A046448FD748EF7BE951A9ABBEBFFC8300F14D139D404AB269EB35590ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 05AE54A8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2692306373.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ae0000_3vj5tYFb6a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226a4a868f480710118b8be8d69b206aff26029ff0bfffae9ecd03f54273569a
Instruction ID: 2a7b5ee6dae5de45b632e27f98446cb5fdd97a317377cf6ccccedb49a7f82631
Opcode Fuzzy Hash: 226a4a868f480710118b8be8d69b206aff26029ff0bfffae9ecd03f54273569a
Instruction Fuzzy Hash: 0EA19D71E00529DFCB14CBA9D980AADFBF1FF88309F288669D455E7205D730E952CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05AE5499 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2692306373.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ae0000_3vj5tYFb6a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b978da9864c8ac54efc4c1c0fa73e6d17b096defb9c1ec4b22e5043dc1e7b5
Instruction ID: 7a44542e6710b90690c481a6cc74c1ff0365bacee3f94292ff980e79a6730c23
Opcode Fuzzy Hash: 81b978da9864c8ac54efc4c1c0fa73e6d17b096defb9c1ec4b22e5043dc1e7b5
Instruction Fuzzy Hash: DA715D71E006299FCB14CFA9D984AAEFBF2FF88315F188529D454E7205D7309942CFA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: aspnet_compiler.exePID: 7512, Parent PID: 2640COMMON

Executed Functions

Function 016A65C8 Relevance: 6.7, Strings: 5, Instructions: 441COMMON

Download Yara Rule

Strings

,nq, xrefs: 016A6898
,nq, xrefs: 016A688A
(ojq, xrefs: 016A6B3D
(ojq, xrefs: 016A6820
(ojq, xrefs: 016A6812

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: (ojq$(ojq$(ojq$,nq$,nq
API String ID: 0-954490635
Opcode ID: 9de48fb3d8bc01e767cff5aec45c29a130e0e46fd71a9ee8570c63708532c342
Instruction ID: 203fe1a3d35d5031b8ffbaa1ef76661be6d2001b3b310aa62e5ec3ed283e8998
Opcode Fuzzy Hash: 9de48fb3d8bc01e767cff5aec45c29a130e0e46fd71a9ee8570c63708532c342
Instruction Fuzzy Hash: 6E024A70A00219DFDB15CF69CD84AAEBBB6BF88300F998069E915AB3A5D730DD51CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016A4577 Relevance: 6.5, Strings: 5, Instructions: 204COMMON

Download Yara Rule

Strings

PHjq, xrefs: 016A47FD
Ljqp, xrefs: 016A4774
PHjq, xrefs: 016A47EC
0oqp, xrefs: 016A460C
Ljqp, xrefs: 016A478A

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: 0oqp$Ljqp$Ljqp$PHjq$PHjq
API String ID: 0-3005213711
Opcode ID: 627a1e2480c2954cf5372fd3d5476f5d1d910c9630bc1b72858abdd4dd7d9a32
Instruction ID: 2be27be5e713d246ed09080bababb71b9162143f0833212987b85090077d2d36
Opcode Fuzzy Hash: 627a1e2480c2954cf5372fd3d5476f5d1d910c9630bc1b72858abdd4dd7d9a32
Instruction Fuzzy Hash: 7A91D274E002588FDB14CFA9D944A9DBBF2BF89310F64C06AE409AB365DB749D45CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016A9278 Relevance: 3.4, Strings: 2, Instructions: 918COMMON

Download Yara Rule

Strings

(ojq, xrefs: 016A9708
4'jq, xrefs: 016A9D03

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: (ojq$4'jq
API String ID: 0-4148772637
Opcode ID: 5da52f6acbfdd0427818c854c6707ed201e9c924db3f673b715a13011f99e7cd
Instruction ID: 814369b9f261536c0e15334c4b2a2acbad6c28d57e5c1ae3934f40104881bbff
Opcode Fuzzy Hash: 5da52f6acbfdd0427818c854c6707ed201e9c924db3f673b715a13011f99e7cd
Instruction Fuzzy Hash: 08826A30A006099FCB15CF68C984AAEBBF6FF88304F658559E5069B3A6D734ED51CF90

Uniqueness

Uniqueness Score: -1.00%

Function 016A5FA0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

Hnq, xrefs: 016A63A6
(ojq, xrefs: 016A64DA

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: (ojq$Hnq
API String ID: 0-4162186043
Opcode ID: c52a97c896edb7ecb88b096278e6860e326e84dae7cc2002e4b868fdace1cca6
Instruction ID: 0d1c24a7a0256138832d8330b7b6ec31ad0af5acd05795fe2e9132d111b21ac2
Opcode Fuzzy Hash: c52a97c896edb7ecb88b096278e6860e326e84dae7cc2002e4b868fdace1cca6
Instruction Fuzzy Hash: B6129C70A002199FDB15CF69CD44AAEBBF6BF88300F148569E80A9B395DF349D42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 016A6CF1 Relevance: 10.5, Strings: 8, Instructions: 510COMMON

Download Yara Rule

Strings

,nq, xrefs: 016A71A0
,nq, xrefs: 016A7190
(ojq, xrefs: 016A6DE9
(ojq, xrefs: 016A6D2E
(ojq, xrefs: 016A6E15
(ojq, xrefs: 016A6EB2
(ojq, xrefs: 016A720F
(ojq, xrefs: 016A71FF

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: (ojq$(ojq$(ojq$(ojq$(ojq$(ojq$,nq$,nq
API String ID: 0-912422979
Opcode ID: 3abdceac43d0d15eb841473ca8bb84b2b5939b12dfdbc922103d3f227c62489c
Instruction ID: 9f999099757092615127729c05bfc6730916411bfa2c1a8c47e70fb9fd8e37fb
Opcode Fuzzy Hash: 3abdceac43d0d15eb841473ca8bb84b2b5939b12dfdbc922103d3f227c62489c
Instruction Fuzzy Hash: 46223930A002498FCB15CF68D984AAEBBF6FF89310F5985A9E5059B3A2D731ED45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016A8280 Relevance: 4.3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

Strings

4'jq, xrefs: 016A82A9
4'jq, xrefs: 016A82CF
;jq, xrefs: 016A86C4

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$;jq
API String ID: 0-1429056558
Opcode ID: 986afbbbfce1d0a69195a36233207f2b7a45b822e6920a8412eaaab6420701e3
Instruction ID: 68bcdf442b371448e5edfec6fa7ade2c463aedf074f7d308834817c9906a17d0
Opcode Fuzzy Hash: 986afbbbfce1d0a69195a36233207f2b7a45b822e6920a8412eaaab6420701e3
Instruction Fuzzy Hash: 6B125E307042118FEB259A2DCD6473D7BAEEF85746F9540AAE502CB3A6DB29CC42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 016A7688 Relevance: 3.2, Strings: 2, Instructions: 707COMMON

Download Yara Rule

Strings

$jq, xrefs: 016A81AC
$jq, xrefs: 016A81CF

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: $jq$$jq
API String ID: 0-3720491408
Opcode ID: 220920410ad1d0bbbe52decc411111167123dee5e8156fc6644ef074ea2eb183
Instruction ID: e0783909661d5ed53bc51e38d6cf69815b4a50be28487ba0dc9b90c55cce8e65
Opcode Fuzzy Hash: 220920410ad1d0bbbe52decc411111167123dee5e8156fc6644ef074ea2eb183
Instruction Fuzzy Hash: 93525E74A002188FEB559BA8CD60BAEBB77FF84301F1080ADC50A6B3A6CB355D85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016A2B71 Relevance: 3.0, Strings: 2, Instructions: 521COMMON

Download Yara Rule

Strings

Xnq, xrefs: 016A2F1E
Xnq, xrefs: 016A2EF5

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: Xnq$Xnq
API String ID: 0-10259684
Opcode ID: 29e21ca7e057bfda96d0f0db0eec2f462dda76df856d9450cf11c5fdde835c81
Instruction ID: df54c6b06c3a2c719c2a6dc5578d700b295b47a728bb7ade3e5d6215ab7c0924
Opcode Fuzzy Hash: 29e21ca7e057bfda96d0f0db0eec2f462dda76df856d9450cf11c5fdde835c81
Instruction Fuzzy Hash: D9025D796CC3D26BD7028A394C4B795FF16AF06710F0C86DAE5948F1C3E2A7958287D2

Uniqueness

Uniqueness Score: -1.00%

Function 016A5530 Relevance: 2.8, Strings: 2, Instructions: 325COMMON

Download Yara Rule

Strings

Hnq, xrefs: 016A564E
Hnq, xrefs: 016A561B

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: Hnq$Hnq
API String ID: 0-3075287205
Opcode ID: 134358d28e462fc3b2b397f34ca3189b554f4d21acc88bd3110e5b61270050b6
Instruction ID: ced4158c3e9a81009dd2ed3ee1a117b7c6af27ab7b1dfa8c2ffe79f74ca45e02
Opcode Fuzzy Hash: 134358d28e462fc3b2b397f34ca3189b554f4d21acc88bd3110e5b61270050b6
Instruction Fuzzy Hash: 9BB19B317042258FDB26DF68DC54A7A7BA2BF88314F558569E807CB3A5DB38CC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 016A5A90 Relevance: 2.7, Strings: 2, Instructions: 237COMMON

Download Yara Rule

Strings

,nq, xrefs: 016A5B70
,nq, xrefs: 016A5B66

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: ,nq$,nq
API String ID: 0-3932345633
Opcode ID: f64c0cc3e106c490e192ff199433916803ac7978cfdc7c20aa45092d82f5b385
Instruction ID: 939d2f3c2bce02eddc94fa3077f77b6c53251183218d5dc2829a3f8e769b6855
Opcode Fuzzy Hash: f64c0cc3e106c490e192ff199433916803ac7978cfdc7c20aa45092d82f5b385
Instruction Fuzzy Hash: D8917D34A002059FCB14DF6DCC9496EBBB6BF89211B9582A9D507EB3A9D731EC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 016A8E20 Relevance: 2.6, Strings: 2, Instructions: 147COMMON

Download Yara Rule

Strings

4'jq, xrefs: 016A8F74
4'jq, xrefs: 016A8F5D

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: b6ade959656a2484f48baa21d12e1888f7d810e368fcedb143a24f85f0f12b0f
Instruction ID: 3a2d8a7513c88b74071343014d894bf2c42e8f318c0cc232836696c4edc22e1e
Opcode Fuzzy Hash: b6ade959656a2484f48baa21d12e1888f7d810e368fcedb143a24f85f0f12b0f
Instruction Fuzzy Hash: FD5180307002459FDB159B6CCC44B6ABBAFEF88351F5480A6EA08CB356EB75CC018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 016A4EF0 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

V, xrefs: 016A4FA4
d8oq, xrefs: 016A4F48

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: V$d8oq
API String ID: 0-68100403
Opcode ID: bb6ca0871c63f0f14805e73eb504840fdf899dff85fbd80da0a0ac2ec6a9b6b1
Instruction ID: 8212cd95f774e7363831c357447307411499581b47a2499663ae748baf061e18
Opcode Fuzzy Hash: bb6ca0871c63f0f14805e73eb504840fdf899dff85fbd80da0a0ac2ec6a9b6b1
Instruction Fuzzy Hash: 13319F303007418FD725DB3DDC58B2A7BAAAFC5314F1484A8E1468B7B2DBA5EC04CB81

Uniqueness

Uniqueness Score: -1.00%

Function 016A0F20 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

LRjq, xrefs: 016A10AA

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: LRjq
API String ID: 0-665714880
Opcode ID: 5b6bc11f9d4a01b27f8130e694a255edfd232b0ef72b84feec8912a54c3ec811
Instruction ID: 34456f550924ad29fdf26ad4eedca161ff88fcfd860905dc9e2b4b01279fc3a8
Opcode Fuzzy Hash: 5b6bc11f9d4a01b27f8130e694a255edfd232b0ef72b84feec8912a54c3ec811
Instruction Fuzzy Hash: C4B1DC70A0120ACFCB14DFB8EA9499EBBB5FF48301B209579D405AB3A5DB396D05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 016A0F30 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

LRjq, xrefs: 016A10AA

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: LRjq
API String ID: 0-665714880
Opcode ID: 9de85d64695e1758712cf5445e76a07cf8c454c2fbc500d7a26986e2610d4097
Instruction ID: b5229e7d0d9f2b0193912555aad3ba8e688b67280c4c9f5a77eb23b0e7f37b62
Opcode Fuzzy Hash: 9de85d64695e1758712cf5445e76a07cf8c454c2fbc500d7a26986e2610d4097
Instruction Fuzzy Hash: B4B1BC70A0120ACFCB14DFB8EA9499EBBB5FF48301B209579D405A73A5DB396D05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 016AA0E0 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

(ojq, xrefs: 016AA269

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: (ojq
API String ID: 0-3210286679
Opcode ID: d24875f5779c065ac41d675e5be0b1be4cc29ed72ca6af1bfa6341a12a735aa2
Instruction ID: 1e55c2a5ff323217b80dbf47a1c71596430570acebe8055cefc9af5ca081d312
Opcode Fuzzy Hash: d24875f5779c065ac41d675e5be0b1be4cc29ed72ca6af1bfa6341a12a735aa2
Instruction Fuzzy Hash: D841AE31B002589FCB199BA8DC146AE7BB6BFC9311F58846ED906D7392CA319C11CB90

Uniqueness

Uniqueness Score: -1.00%

Function 016A4F89 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

V, xrefs: 016A4FA4

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: aee2350c25bd30692d6721b113ab02be8871d11663aa6092f764ea4215d4a530
Instruction ID: 78f76e4d08fcf0c6b66c0222172e4d22b81130db0073532459b642927a71f7e1
Opcode Fuzzy Hash: aee2350c25bd30692d6721b113ab02be8871d11663aa6092f764ea4215d4a530
Instruction Fuzzy Hash: B741D0307487418FC726CB38EC58A6A3FB5AF82214B1844EEE446CB7A2DB659C05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 016A4F0B Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

d8oq, xrefs: 016A4F48

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: d8oq
API String ID: 0-2048867746
Opcode ID: 12c3e886dcdb9c6000c1d6a36224c68b8e89e09de23d16495f9990729f6682b1
Instruction ID: eb2d95baa474d869d1dee1b8e9c7f2c4e76afd5a6fb196803412d4bf2355f1ac
Opcode Fuzzy Hash: 12c3e886dcdb9c6000c1d6a36224c68b8e89e09de23d16495f9990729f6682b1
Instruction Fuzzy Hash: 67014F302007858FDB25EB2DDC48B6AFBDAAFC0314F14D928D15687665EFA4EC49CB41

Uniqueness

Uniqueness Score: -1.00%

Function 016AA2A8 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3bd3998604294dc61df9ed566fc8fdf020fd82b80b9c05f3ccc13cd3775169f
Instruction ID: 891f9d1ecc6d6dd795130208f2dec08943c456dc0f5b987f348ee782b56700ca
Opcode Fuzzy Hash: f3bd3998604294dc61df9ed566fc8fdf020fd82b80b9c05f3ccc13cd3775169f
Instruction Fuzzy Hash: EEF12C75A002158FCB15CFACC9889ADBBF6FF89310B5A845AE505AB365CB35EC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 016A72D0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18dde3b3ed959506870470828a61a5c5ec01782de338f692246ef6aad530b4c3
Instruction ID: a24072ec864c67d2a601d2d408b1ab623c180406a638a6e5f0cd4fb9b394139c
Opcode Fuzzy Hash: 18dde3b3ed959506870470828a61a5c5ec01782de338f692246ef6aad530b4c3
Instruction Fuzzy Hash: D871F3347002458FDB25DF28C898A6A7BE6EF49744B5900A9E906CB3B2DB72DC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 016A37D0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2878b0b3fe68c2457cfdac92c7facef9468b4513c9c948f041c99cfc112807
Instruction ID: e572aec3b7c395777d53a83e4ea8070fe0de8c150ae0c3171b6ae8089698f447
Opcode Fuzzy Hash: fe2878b0b3fe68c2457cfdac92c7facef9468b4513c9c948f041c99cfc112807
Instruction Fuzzy Hash: F0517274E01208DFCB18DFA9D98499DBBB2FF89310B609069E805BB364DB35AD46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 016A94F3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56448f62ad4161884a72080dcf3e744b96cdd8a4cfc2d79fa3b99762b66b9341
Instruction ID: 38b9784e191bc083c269d3d352be5d9dfc10014b8726ae802ba4d7e789765ca7
Opcode Fuzzy Hash: 56448f62ad4161884a72080dcf3e744b96cdd8a4cfc2d79fa3b99762b66b9341
Instruction Fuzzy Hash: 6041BB30A002599FDF22CFA8CC45AADBFB2AF49318F608055E9559B256D331ED15CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 016A6BF1 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3fb18502806bbdd65fd3937e9b3349020621a1b13aa3876df9b08a22351f323
Instruction ID: 8fa22a45e0f8ff90b123bf360c2e4c2d444cfd970c3ec6eb9bf726f9a2b329a7
Opcode Fuzzy Hash: b3fb18502806bbdd65fd3937e9b3349020621a1b13aa3876df9b08a22351f323
Instruction Fuzzy Hash: 15415E71A046109FC716CF6CCC48A557BA5EF4A324B5986A6E91ACF3B2C331EC11CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 016A4850 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f1993996673e3bb8a2e6db579b2b493a1773420d53cc1cafd8f3863c7f788b
Instruction ID: ec509542897c1fa09a4ea297493d1e5b2f8d98a951531e6ad26a2c064cbf58ee
Opcode Fuzzy Hash: 43f1993996673e3bb8a2e6db579b2b493a1773420d53cc1cafd8f3863c7f788b
Instruction Fuzzy Hash: 74315B3160410A9FCB169FA8DC44ABF3BA6FB88211F544028F9059B395CB79CD61CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 016A7568 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c197b7ece5bb202ef61ffbf9e6863693fd69bad9104128f368c88a3356fbcee
Instruction ID: e4056ba9aef751f0c3500566d3fd3e0f0c9b9b17a5ffb30b55832faa8d181789
Opcode Fuzzy Hash: 5c197b7ece5bb202ef61ffbf9e6863693fd69bad9104128f368c88a3356fbcee
Instruction Fuzzy Hash: 3F21E5307042614FDB2A173D8D5467E7B97AFC9654B98507AD402CB3AAEF26CC029F91

Uniqueness

Uniqueness Score: -1.00%

Function 016AA297 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3772969e3ccfc2627262be8256f31703fb1df560949ecc1bb0fcae4e2e1ce78
Instruction ID: 3d42a944289fb5993801578cb26fe3e32415ea5bee8aafc1f866a3c562b5ec60
Opcode Fuzzy Hash: e3772969e3ccfc2627262be8256f31703fb1df560949ecc1bb0fcae4e2e1ce78
Instruction Fuzzy Hash: 9C319270A006158FCB05CFACCC849AFBBB6BF89320B55855AE515DB3A6CB759C42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 016A7578 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73cedfbe89b2ff97779126620d13e547a9645a419de64218b63d73843cc39aa6
Instruction ID: 52fd9475fb8a744a69f4b0643fa57104d32b66523b5fb59174812e645fe75af2
Opcode Fuzzy Hash: 73cedfbe89b2ff97779126620d13e547a9645a419de64218b63d73843cc39aa6
Instruction Fuzzy Hash: FE21D4303042214BEB2A272D8D54B7E768BAFC8714F945039D506CB399EF3ACC42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 016A8D8A Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f54dbb3fc6a2a472ae5e027742df5f16c6ede47f71733fccec507f3add386ae
Instruction ID: 2caf21ba37819452ebd716a1d7d7874234b68e12b20a8fd760993e24bbef982b
Opcode Fuzzy Hash: 2f54dbb3fc6a2a472ae5e027742df5f16c6ede47f71733fccec507f3add386ae
Instruction Fuzzy Hash: F931AD31605245DFCB12DF1CD8849AABBFAFF49361F9488A2E944D7215C731ED228BA1

Uniqueness

Uniqueness Score: -1.00%

Function 016A4840 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f699a78dd64bfe5b5bd7099369507e8b126c103edb17c24526e925d52a8eaa
Instruction ID: badbf16f4befb298afb77c67ea7bb693efff6564c478b49de0dd442d8e2dfcff
Opcode Fuzzy Hash: 97f699a78dd64bfe5b5bd7099369507e8b126c103edb17c24526e925d52a8eaa
Instruction Fuzzy Hash: DD31D131A042858FCB269F28EC0863B3BA6FB45311F59446DE505CB396CB78CC15CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 016A1B20 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c69ea0c246c93b8b3296890857602ce495a6ba42b3975e9c4d585fa8c090a2
Instruction ID: b60edef477c742ef58422696f3a5ccf854be195078deb5412db8b3ae4372c4d7
Opcode Fuzzy Hash: 07c69ea0c246c93b8b3296890857602ce495a6ba42b3975e9c4d585fa8c090a2
Instruction Fuzzy Hash: 8D21B235A001159FCB15CF78C9409AE77B5EF8A260F50C069D8199B354EB35EE02CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 016A58F5 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a7cd2a2f98d70a89e93539ed345fcb2d0b155aeffd3b328b1c461cce1e1b26
Instruction ID: 7e62ac294f5cf72978c6b03d75b073b1a8382703874f435edcb0d86c4bb67ff1
Opcode Fuzzy Hash: d7a7cd2a2f98d70a89e93539ed345fcb2d0b155aeffd3b328b1c461cce1e1b26
Instruction Fuzzy Hash: 3E21CD357006128FD729DA69DC5493EB7A2FB8A621B15816AE907CF3A4CF34DC028FC0

Uniqueness

Uniqueness Score: -1.00%

Function 0160D4F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2744995907.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_160d000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8556ac1206145bb6daa5cab8508eb5e0966880434f50c7640a8c6bf4ce9130d0
Instruction ID: 216597ffaf59f7e5d04b87fd900d57bf572c840b441ea54b50bdf3f15df8f058
Opcode Fuzzy Hash: 8556ac1206145bb6daa5cab8508eb5e0966880434f50c7640a8c6bf4ce9130d0
Instruction Fuzzy Hash: 9121C471504204DFDB1BDF98D980B27BF65FB98318F248669ED090A296C337D456CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 016A8959 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c5a715fce6d289a102258c464698be1f01f52c358ac14b832e67f008dbc18e
Instruction ID: 4f12d85c79d8a13bd0ff4cd82110301290d89c46d91bf05439204f416efe906d
Opcode Fuzzy Hash: c6c5a715fce6d289a102258c464698be1f01f52c358ac14b832e67f008dbc18e
Instruction Fuzzy Hash: 8C214B70A002489FDB15CFA9D950AAEBFB6FF88241F64806AE551B7290DB359D41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 016A58F8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d261c3e9b3e8a5d887b2b5e5d1486dc839e0747bef6f035893db0fa17082d33c
Instruction ID: df31f11d5d1a509318f64513e62461e7286f2663784f12a552c8480054e1422f
Opcode Fuzzy Hash: d261c3e9b3e8a5d887b2b5e5d1486dc839e0747bef6f035893db0fa17082d33c
Instruction Fuzzy Hash: 1111CE313006128FD7299A2ADC5493EB7A6FF8A66175500A9EA07CF364DF24DC028BC0

Uniqueness

Uniqueness Score: -1.00%

Function 016A1A1F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d14c20f8a5975de8b2379beb8a484eb32677a5de412fbbbdc6de2fadf5533b5a
Instruction ID: 801495c607302ec037859c9f9d07f19b9d743978c5a926b75fcc84ee4303f17a
Opcode Fuzzy Hash: d14c20f8a5975de8b2379beb8a484eb32677a5de412fbbbdc6de2fadf5533b5a
Instruction Fuzzy Hash: 6121ABB4C0520A8FCB50EFA8D9555EEBFF4FB4A310F10916AD805B3224EB345A95CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0160D4EB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2744995907.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_160d000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 8693b099d3e779a63bbfc55677f2f6f2aab698eb329948234fb839d48d0be179
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 2C119D76504240CFDB17CF54D9C4B16BF61FB88314F24C6A9DD090A256C336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 016A5091 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00c9692ff84a238f5bfa93f5a821c6157418874eb6cd6dfae638f8207c080f8
Instruction ID: 50b1c034bdcd4b624be4440f2fc33b426feaead6f4db5016764d88f1b3ffcfe7
Opcode Fuzzy Hash: c00c9692ff84a238f5bfa93f5a821c6157418874eb6cd6dfae638f8207c080f8
Instruction Fuzzy Hash: 690184326442555FDB16DE699C106BF3FA7EBC9651B18802AFA06CB290DB31CC11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 016A1AD0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36612c7e4268818c7e80cd45f8825bc053d72ba1d62a71178ed1545030cabf6
Instruction ID: c7da7712103779cfaef955f9172627b6cdf11954f6692bba887f8cbe2a9e0317
Opcode Fuzzy Hash: d36612c7e4268818c7e80cd45f8825bc053d72ba1d62a71178ed1545030cabf6
Instruction Fuzzy Hash: ECE0D831D103668FCB169B70DE050EEBF70FEC2320B45866BD55066164EB302A5EC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 016A5D31 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6f2e7fb2735c92fd1320f3b2ad2acdc7680766b0d29ce98cba3dbc414d1064
Instruction ID: 99eabb98c3149ef0191023c01acf746302cdf833575c3b8ec23277a6f2370a84
Opcode Fuzzy Hash: ed6f2e7fb2735c92fd1320f3b2ad2acdc7680766b0d29ce98cba3dbc414d1064
Instruction Fuzzy Hash: 76E086744543454FC72BEF34AE444953F7AEE81205B08C5A6E4064A166D73D9C0E8B50

Uniqueness

Uniqueness Score: -1.00%

Function 016A1AE0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f380fe5c9b075a9636130c7adf48786aa77b7465d5f4df2e8041174ce00f58
Instruction ID: abe0d539bdd350f02f572a56405242d6caece130a91899ba2cdc6af8340b7287
Opcode Fuzzy Hash: d8f380fe5c9b075a9636130c7adf48786aa77b7465d5f4df2e8041174ce00f58
Instruction Fuzzy Hash: DFD05B31D2022B57CB01E7A5DC044EFF738EED6261B544666D51437154FB702659C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 016A80F0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: e03a3704c8fe1038007f469f57256950523d4c30af29877763bfdd0c1c6d132e
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 10C08C3320C1282BA225208F7C40EB3BB8CD3C23B7A610137F51CC3200A842AC8102F4

Uniqueness

Uniqueness Score: -1.00%

Function 016A5D40 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172b2d14c0953dfad886b37751f618a6b803ab2d1bae4f2bdb7647010e2cbf1e
Instruction ID: 22999be8b815538d5301280e7291346fc200ba4ea52db18fa87e6c2796cbf69e
Opcode Fuzzy Hash: 172b2d14c0953dfad886b37751f618a6b803ab2d1bae4f2bdb7647010e2cbf1e
Instruction Fuzzy Hash: 48C0C93014020A4EC62AAF75BF44926362EEA80205B505570A1090A269EE7D984C86A4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 016A1C10 Relevance: 5.2, Strings: 4, Instructions: 214COMMON

Download Yara Rule

Strings

Xnq, xrefs: 016A1D87
Xnq, xrefs: 016A1D08
Xnq, xrefs: 016A1DD4
Xnq, xrefs: 016A1CCE

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: Xnq$Xnq$Xnq$Xnq
API String ID: 0-1335687363
Opcode ID: 5797fc5ca10ccd78ce232b618cc7d2979e4cf6915eedc4c02040b2354a6b24fb
Instruction ID: 3e33911e3034094f374761773eee638f254c65ce6fd1c193425344f0e62a3044
Opcode Fuzzy Hash: 5797fc5ca10ccd78ce232b618cc7d2979e4cf6915eedc4c02040b2354a6b24fb
Instruction Fuzzy Hash: 3671E231E003198FDF21ABA88D507EEBBB6BF86300F54856AD505A7395DB308D85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 016A1CA8 Relevance: 5.1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

Strings

Xnq, xrefs: 016A1D87
Xnq, xrefs: 016A1D08
Xnq, xrefs: 016A1DD4
Xnq, xrefs: 016A1CCE

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: Xnq$Xnq$Xnq$Xnq
API String ID: 0-1335687363
Opcode ID: 4ee081d2bbcf2437b8bc0596f15d38d833107386312452b704b0a66762f3b81f
Instruction ID: c13682cc459dce80faf3861543772cc95456aac013c3d14c3c5cddd43ef59852
Opcode Fuzzy Hash: 4ee081d2bbcf2437b8bc0596f15d38d833107386312452b704b0a66762f3b81f
Instruction Fuzzy Hash: 23317272E002294BDF64AB6C8D5036FBAB6BB86300F544569C519A7385DB308E85CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 016A5F20 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;jq, xrefs: 016A5F52
\;jq, xrefs: 016A5F5E
\;jq, xrefs: 016A5F2C
\;jq, xrefs: 016A5F36

Memory Dump Source

Source File: 00000016.00000002.2745320592.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_16a0000_aspnet_compiler.jbxd

Similarity

API ID:
String ID: \;jq$\;jq$\;jq$\;jq
API String ID: 0-138087212
Opcode ID: ec17e4fc929f6f06b5e57a972b84a0bd57c22a3978eccd478347e0a8889ae6aa
Instruction ID: 5ace5fec3d171c0d380f454f4841677faa65c1babe6c5bc6a252bc068e366494
Opcode Fuzzy Hash: ec17e4fc929f6f06b5e57a972b84a0bd57c22a3978eccd478347e0a8889ae6aa
Instruction Fuzzy Hash: FE0156317406158F8B24CE2DC94092A77EEAF887607A981AAE503CB3B1DB30DC428F91

Uniqueness

Uniqueness Score: -1.00%

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chronv.exe	Virustotal: Detection: 63%			Perma Link

Source: unknown	HTTPS traffic detected: 172.67.160.84:443 -> 192.168.2.5:49721 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.28.190:443 -> 192.168.2.5:49722 version: TLS 1.0

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3vj5tYFb6a.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aspnet_compiler._671408d8f99b945fb318820b118cbaac1562996_00cd84b8_f5ae1b8c-e8f9-4fa2-8207-26e2105f9599\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC146.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3D8.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC417.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3vj5tYFb6a.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2d0gjoqk.sfu.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2j3gfvi2.ptu.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30ymwsh2.ost.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3hpsvg4t.zqq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_asve4awe.s5t.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c4zc4s5g.2ys.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dst3jkid.lw4.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dt4k2am1.omo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hbzqjbhw.1m1.psm1

Windows Analysis Report
3vj5tYFb6a.exe

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre