Edit tour

Windows Analysis Report
umPJEpnOgL.exe

Overview

General Information

Sample name:	umPJEpnOgL.exe renamed because original name is a hash value
Original sample name:	57a49a947bf36386839f2691a692b329.exe
Analysis ID:	1463289
MD5:	57a49a947bf36386839f2691a692b329
SHA1:	96aacde39613abc5edbed8ea428a1bf43883c57e
SHA256:	783669c0f379d23beab6567975bcf3748ed8e0a91f467c52e12ba597e568940e
Tags:	DCRatexe
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Yara detected DCRat

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates processes via WMI

Drops PE files to the user root directory

Drops PE files with benign system names

Drops executable to a common third party application directory

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

umPJEpnOgL.exe (PID: 6520 cmdline: "C:\Users\user\Desktop\umPJEpnOgL.exe" MD5: 57A49A947BF36386839F2691A692B329)

schtasks.exe (PID: 6712 cmdline: schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6752 cmdline: schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6808 cmdline: schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6848 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6900 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2504 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7004 cmdline: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7068 cmdline: schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7092 cmdline: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7096 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 11 /tr "'C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 824 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5812 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 7 /tr "'C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3068 cmdline: schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\services.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1104 cmdline: schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\services.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7008 cmdline: schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\services.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6732 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 11 /tr "'C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6828 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6868 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 13 /tr "'C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6900 cmdline: schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemTemp\smss.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2504 cmdline: schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\SystemTemp\smss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7004 cmdline: schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\SystemTemp\smss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7068 cmdline: schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Default\explorer.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7092 cmdline: schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7100 cmdline: schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1668 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\windows nt\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3864 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Program Files (x86)\windows nt\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2492 cmdline: schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windows nt\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6828 cmdline: schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6944 cmdline: schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6984 cmdline: schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7052 cmdline: schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\sihost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7088 cmdline: schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\sihost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3848 cmdline: schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\LiveKernelReports\sihost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe (PID: 6224 cmdline: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe MD5: 57A49A947BF36386839F2691A692B329)

DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe (PID: 2496 cmdline: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe MD5: 57A49A947BF36386839F2691A692B329)

System.exe (PID: 6204 cmdline: "C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe" MD5: 57A49A947BF36386839F2691A692B329)

System.exe (PID: 6492 cmdline: "C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe" MD5: 57A49A947BF36386839F2691A692B329)

winlogon.exe (PID: 6780 cmdline: "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe" MD5: 57A49A947BF36386839F2691A692B329)

winlogon.exe (PID: 6852 cmdline: "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe" MD5: 57A49A947BF36386839F2691A692B329)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{
  "SCRT": "{\"e\":\"_\",\"B\":\"<\",\"p\":\"`\",\"G\":\"(\",\"4\":\"#\",\"N\":\"$\",\"d\":\",\",\"J\":\">\",\"h\":\"@\",\"O\":\"|\",\"L\":\"%\",\"0\":\".\",\"M\":\"*\",\"j\":\"-\",\"I\":\" \",\"o\":\"!\",\"U\":\"~\",\"D\":\"^\",\"l\":\"&\",\"m\":\")\",\"T\":\";\"}",
  "PCRT": "{\"S\":\"*\",\"D\":\"_\",\"j\":\"&\",\"x\":\")\",\"w\":\"~\",\"c\":\"`\",\"b\":\"@\",\"=\":\".\",\"0\":\";\",\"y\":\"<\",\"i\":\">\",\"6\":\"$\",\"l\":\",\",\"I\":\"%\",\"p\":\"(\",\"f\":\"^\",\"M\":\"|\",\"e\":\" \",\"Q\":\"!\",\"X\":\"#\"}",
  "TAG": "",
  "MUTEX": "DCR_MUTEX-30QfYMo2y4CxfAxsCGwi",
  "LDTM": false,
  "DBG": false,
  "SST": 5,
  "SMST": 2,
  "BCS": 0,
  "AUR": 1,
  "ASCFG": {
    "searchpath": "%UsersFolder% - Fast"
  },
  "AS": false,
  "ASO": false,
  "AD": false,
  "H1": "http://a0994587.xsph.ru/@=QzNzYzMiFGN",
  "H2": "http://a0994587.xsph.ru/@=QzNzYzMiFGN",
  "T": "0"
}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000010.00000002.1843698850.0000000002838000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000D.00000002.1845475045.0000000002F88000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1777428806.00000000024E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000012.00000002.1848659851.00000000026B8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000013.00000002.1845832491.0000000002657000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000015.00000002.1847435406.0000000002951000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000015.00000002.1847435406.0000000002998000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000018.00000002.1849515045.0000000002988000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1777428806.00000000029D3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000D.00000002.1845475045.0000000002F55000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000010.00000002.1843698850.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000013.00000002.1845832491.0000000002625000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000012.00000002.1848659851.0000000002671000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000018.00000002.1849515045.0000000002941000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: umPJEpnOgL.exe PID: 6520	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe PID: 6224	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe PID: 2496	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: System.exe PID: 6204	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: System.exe PID: 6492	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: winlogon.exe PID: 6780	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: winlogon.exe PID: 6852	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\umPJEpnOgL.exe, ProcessId: 6520, TargetFilename: C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe", CommandLine: "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe", CommandLine|base64offset|contains: , Image: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe, NewProcessName: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe, OriginalFileName: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe", ProcessId: 6780, ProcessName: winlogon.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe", CommandLine: "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe", CommandLine|base64offset|contains: , Image: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe, NewProcessName: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe, OriginalFileName: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe", ProcessId: 6780, ProcessName: winlogon.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /f, CommandLine: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\umPJEpnOgL.exe", ParentImage: C:\Users\user\Desktop\umPJEpnOgL.exe, ParentProcessId: 6520, ParentProcessName: umPJEpnOgL.exe, ProcessCommandLine: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /f, ProcessId: 7004, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: umPJEpnOgL.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://a0994587.xsph.ru/@=QzNzYzMiFGN

Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Windows\SystemTemp\smss.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\Default\explorer.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\services.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Windows\LiveKernelReports\sihost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984

Found malware configuration

Source: 00000000.00000002.1777428806.00000000024E1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"e\":\"_\",\"B\":\"<\",\"p\":\"`\",\"G\":\"(\",\"4\":\"#\",\"N\":\"$\",\"d\":\",\",\"J\":\">\",\"h\":\"@\",\"O\":\"|\",\"L\":\"%\",\"0\":\".\",\"M\":\"*\",\"j\":\"-\",\"I\":\" \",\"o\":\"!\",\"U\":\"~\",\"D\":\"^\",\"l\":\"&\",\"m\":\")\",\"T\":\";\"}", "PCRT": "{\"S\":\"*\",\"D\":\"_\",\"j\":\"&\",\"x\":\")\",\"w\":\"~\",\"c\":\"`\",\"b\":\"@\",\"=\":\".\",\"0\":\";\",\"y\":\"<\",\"i\":\">\",\"6\":\"$\",\"l\":\",\",\"I\":\"%\",\"p\":\"(\",\"f\":\"^\",\"M\":\"|\",\"e\":\" \",\"Q\":\"!\",\"X\":\"#\"}", "TAG": "", "MUTEX": "DCR_MUTEX-30QfYMo2y4CxfAxsCGwi", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false, "H1": "http://a0994587.xsph.ru/@=QzNzYzMiFGN", "H2": "http://a0994587.xsph.ru/@=QzNzYzMiFGN", "T": "0"}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe	ReversingLabs: Detection: 84%
Source: C:\ProgramData\SoftwareDistribution\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	ReversingLabs: Detection: 84%
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	ReversingLabs: Detection: 84%
Source: C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	ReversingLabs: Detection: 84%
Source: C:\Recovery\services.exe	ReversingLabs: Detection: 84%
Source: C:\Users\Default\explorer.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\LiveKernelReports\sihost.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\SystemTemp\smss.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\Tasks\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\en-GB\RuntimeBroker.exe	ReversingLabs: Detection: 84%

Multi AV Scanner detection for submitted file

Source: umPJEpnOgL.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Windows\SystemTemp\smss.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe	Joe Sandbox ML: detected
Source: C:\Users\Default\explorer.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Joe Sandbox ML: detected
Source: C:\Recovery\services.exe	Joe Sandbox ML: detected
Source: C:\Windows\LiveKernelReports\sihost.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: umPJEpnOgL.exe

Joe Sandbox ML: detected

Source: umPJEpnOgL.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\27d1bcfc3c54e0	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Google\Chrome\Application\8b5d9cd934bf30	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\5940a34987c991	Jump to behavior

Source: umPJEpnOgL.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://a0994587.xsph.ru/@=QzNzYzMiFGN

Source: umPJEpnOgL.exe, 00000000.00000002.1777428806.00000000029D3000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\Containers\8b5d9cd934bf30	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\SystemTemp\smss.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\SystemTemp\smss.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\SystemTemp\69ddcba757bf72	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\LiveKernelReports\sihost.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\LiveKernelReports\sihost.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\LiveKernelReports\66fc9ff0ee96c2	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\en-GB\RuntimeBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\en-GB\RuntimeBroker.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\en-GB\9e8d7a4ca61bd9	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\Tasks\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\Tasks\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\Tasks\8b5d9cd934bf30	Jump to behavior

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Code function: 0_2_00007FFD9B8835C5
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Code function: 13_2_00007FFD9B8B35C5
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Code function: 16_2_00007FFD9B8735C5
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Code function: 18_2_00007FFD9B8B35C5
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Code function: 19_2_00007FFD9B8835C5
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Code function: 21_2_00007FFD9B8B35C5
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Code function: 24_2_00007FFD9B8735C5

Source: umPJEpnOgL.exe	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: WmiPrvSE.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: services.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe0.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: umPJEpnOgL.exe, 00000000.00000000.1728849554.00000000003A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs umPJEpnOgL.exe
Source: umPJEpnOgL.exe, 00000000.00000002.1780968289.000000001B881000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameli vs umPJEpnOgL.exe
Source: umPJEpnOgL.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs umPJEpnOgL.exe

Source: umPJEpnOgL.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: umPJEpnOgL.exe, yRGFAjhak0p4uIALEl9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: umPJEpnOgL.exe, yRGFAjhak0p4uIALEl9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: umPJEpnOgL.exe, b2kpdpTgPOukbOj59eG.cs	Cryptographic APIs: 'TransformBlock'
Source: umPJEpnOgL.exe, b2kpdpTgPOukbOj59eG.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@35/49@0/0

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe

Jump to behavior

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

File created: C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe

Jump to behavior

Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\9a0ed12ef210c25412461a7ebf3ac6f9c008b68d

Source: umPJEpnOgL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: umPJEpnOgL.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: umPJEpnOgL.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

File read: C:\Users\user\Desktop\umPJEpnOgL.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\umPJEpnOgL.exe "C:\Users\user\Desktop\umPJEpnOgL.exe"
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe'" /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 11 /tr "'C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 7 /tr "'C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\services.exe'" /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\services.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\services.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe "C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe "C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe"
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 11 /tr "'C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f
Source: unknown	Process created: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 13 /tr "'C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\windows nt\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Program Files (x86)\windows nt\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windows nt\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\sihost.exe'" /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\sihost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\LiveKernelReports\sihost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: slc.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: mscoree.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: apphelp.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: version.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: wldp.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: profapi.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: mscoree.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: version.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: wldp.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: profapi.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: version.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: wldp.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: profapi.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: version.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: wldp.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: profapi.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: version.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: wldp.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: profapi.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: version.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: wldp.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: profapi.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\27d1bcfc3c54e0	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Google\Chrome\Application\8b5d9cd934bf30	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe	Jump to behavior
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\5940a34987c991	Jump to behavior

Source: umPJEpnOgL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: umPJEpnOgL.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: umPJEpnOgL.exe, yRGFAjhak0p4uIALEl9.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: umPJEpnOgL.exe, LZuWjtycyVTIHKYyHHC.cs	.Net Code: AIS1j5akBc System.AppDomain.Load(byte[])
Source: umPJEpnOgL.exe, LZuWjtycyVTIHKYyHHC.cs	.Net Code: AIS1j5akBc System.Reflection.Assembly.Load(byte[])
Source: umPJEpnOgL.exe, LZuWjtycyVTIHKYyHHC.cs	.Net Code: AIS1j5akBc

Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Code function: 13_2_00007FFD9B8C52E4 push E8FFFFFFh; ret
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Code function: 18_2_00007FFD9B8C52E4 push E8FFFFFFh; ret
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Code function: 19_2_00007FFD9B8952E4 push E8FFFFFFh; ret
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Code function: 21_2_00007FFD9B8C52E4 push E8FFFFFFh; ret
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Code function: 24_2_00007FFD9B8852E4 push E8FFFFFFh; ret

Source: umPJEpnOgL.exe, h66cTJyLj6TDjIlXhQn.cs	High entropy of concatenated method names: 'vc6E56cTJj', 'jlaYw0OBgIvgepk0v4e', 's8wfORObQC8ifUi9xIY', 'owxKSUO9s0R4XsJsDss', 'o2XqTtOpqN8CJJg4E0l', 'gSurYDOzIBUEVPNOl3q', 'PqcfCkIS6tfuZ8fI4Ec', 'd7eDCwIUYUHSwXfXkVO', 'CD1F3iIA9J0MG71WMLT', 'kk1INtI8nwtjY8BduT7'
Source: umPJEpnOgL.exe, aQcuiVxeWpP2T9pq8l.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'gT4yloABfpPQqODtwTg', 'BruQI3Ab7dwXOvLMeEm', 'LWHWb9AzxhEuRc1OftL', 'y4Eg018ShY3sUVTgiTK', 'y8Nvij8UZflQZCkBslA', 'WGjB4O8ACEB1XHadcxN'
Source: umPJEpnOgL.exe, FjcJiOEmMTwG3R1P4l4.cs	High entropy of concatenated method names: 'CNrSDVQjWh', 'B8xSIxTZVt', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'YhrS5BVgKe', '_5f9', 'A6Y'
Source: umPJEpnOgL.exe, tnlGsI1pJBYDoN3HSdN.cs	High entropy of concatenated method names: 'DCMhtyOZp0', 'MfvhNROHJb', 'vg6hFx9fP4', 'jJTh4FqRdN', 'E2bh68Kfnn', 'RQEhUaqsx7', 'y57R3l4gJjOkbKwqnG7', 'b9ExOC4uHdcpPnqP7ia', 'wN0KQI4wFOH3IFu2sOY', 'ulp81946Wh6L52ZtDL1'
Source: umPJEpnOgL.exe, XFlvbSTVrDXF6H5WRZg.cs	High entropy of concatenated method names: 'ePJIec2CFu', 'fGilJ1X6JFGZroKiUwg', 'XXQ83MXaLZxPreR6Ljp', 'gZGV05XwWCmL9VmuIi1', 'LXkwBRXgMNZettNxBSt', '_1fi', 'wfeDsSE9FJ', '_676', 'IG9', 'mdP'
Source: umPJEpnOgL.exe, yRGFAjhak0p4uIALEl9.cs	High entropy of concatenated method names: 'OFWmN6HF4rQeeNOfnqo', 'yo88d8Hu0eQptKTpwLL', 'Cned1qHxUp6DYwYmjA5', 'w5fTHjH1biLR8d7e3CZ', 'ej0HjYZdQ2', 'rACG7eH6eZo20WTHwhf', 'kTHog8HaJ6C5AxxgECg', 'H7AM4IHGmQfdZwSyXUM', 'tg0T8yH0WLEE3I9FWZI', 'OxZiumHfAfFOP8MAHLC'
Source: umPJEpnOgL.exe, Xb96WCyeKeKBiwlCT27.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'YCFELUEbX7', 'KIUExpKb96', 'sCKEVeKBiw', 'nCTEe27hhN', 'vrJEd71apV', 'SKxKHmImcKmEFDQaIZa', 'AZLE3kIdvKrTdulQmsD', 'noitMPIRO3gTgm8MbdY'
Source: umPJEpnOgL.exe, gDcFewfcVvY3HTbrqhV.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'kERFCbRRw9IaIq4108Y', 'OfqolbRVfVix3kYPBXw', 'kuxPKqRmeEiKVQge7Rs', 'ftfs3jRdEBPs1V6sLaP', 'YV1V5DRinOWtBU712Gd', 'lMeO60Rv5SfvhuCxLUo'
Source: umPJEpnOgL.exe, LaWRHwtb90FETfXZEs.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'NkD1m1Ci2DDBNKb2bx9', 'RcDwcPCv32WI5tbdgeW', 'Oadt4OCWD2yweHgogCJ', 'WEpyuaCjD6R7pbkJLXr', 'PbtTrJC5Z72XwfUaXkS', 'qe8mZKCMEuP79AREPQ1'
Source: umPJEpnOgL.exe, messtPfwAcXhKYnXimN.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'yp4yqjRutCEviEXlQDJ', 'idtCk2Rw66ZRiU6AYjb', 'wqxeWBRgK7WPPr2ngPM', 'hqLR2nR6GTeQ42QOoj0', 'mWYoDNRa412RlVUn4Vi', 'utdFI6RGCWv12jNcBVi'
Source: umPJEpnOgL.exe, QTr1P9TIVNqLV5ybTGr.cs	High entropy of concatenated method names: 'c1xJcAtKa6', 'cdZJObcPWo', 'HxAJQ233qc', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'CHQJ0dYqMG'
Source: umPJEpnOgL.exe, bYYaiREIuslvmCjJJQS.cs	High entropy of concatenated method names: 'cT2qF7TIlf', 'xqTq4efPog', 'ivHq65cJ1a', 'Ix6S862Ly1v6RSYZCwX', 'NVnKCH20w6voYnHAfEB', 'As6bPD2fBchUitJr2JB', 'gRQ7Gl2csxFubsQZZkq', 'XC7FFl22JxIebMtcyM4'
Source: umPJEpnOgL.exe, bTPmQuyyLxhMVlpkKg6.cs	High entropy of concatenated method names: 'iNvyUrPU8G', 'VQZyRKKdku', 'uRGy9tiNYm', 'BRFysP6f0p', 'H3LyvUddvg', 'I8QyZk3FBk', 'HZETnkWIoP1iZ6Rhsa6', 'OpdTxiWQPtvPoiRemwL', 'hVjshOWKNegkPMZM2Mw', 'bpNiPuWOT1feUiwriU0'
Source: umPJEpnOgL.exe, NSRok21YVc70S8qrmGL.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'xXDQkhrjPvRplNeMbN3', 'j0hRgdr5qCKCfZQ1fPj', 'Pn9hucrMAfGiOKkl5PG', 'Bri4cJrKxKQjdQXmShs'
Source: umPJEpnOgL.exe, CYUf4T1OuGp0PTiRMeb.cs	High entropy of concatenated method names: 'mCJr2OsUwh', 'KQrrLLk5n7', 'LSurxJMfXS', 'iqaVemk55cCNY0nVd9s', 'HxXqy4kWJVsDDUOrLwE', 'd6tAX3kjeR7PypIbFZa', 'xlwKuCkMB7GgwoWkcVd', 'VbbrlfyVla', 'eUCrGscWT9', 'KayrXo9UER'
Source: umPJEpnOgL.exe, wR73ODEJI4CiO2h9uQb.cs	High entropy of concatenated method names: 'OLpqdNaKT4', 'unTqkQmR0B', 'BdHq38ll03', 'Fffqt6Uy7n', 'lGLqNWbKAg', 'eKmZ3o2wXrrRd9OOIgY', 'n0R4KQ2FZcawdDAEwWi', 'J7ytHm2ujwUrD91HdKe', 'JcNtc32gPvvWLDRHfhs', 'ul18DW26cYmKtSUstif'
Source: umPJEpnOgL.exe, rICrAf1Cbh2uH3O9ejO.cs	High entropy of concatenated method names: 'v2gAevx2A9vdNjsLksI', 'tDapqNx36cs6AfwWQwP', 'dHtaNrxLh1U1yQRBDtq', 'nP35psxcRYKRh9ujPqo', 'IWF', 'j72', 'GlVOX3b09d', 'tAKOnALaV6', 'j4z', 'abAOirhmwj'
Source: umPJEpnOgL.exe, ncK54Eh9YggKISnN4f.cs	High entropy of concatenated method names: 'Y54aE9Ygg', 'wDfEux0rNRXwacBV1W', 'oItWX7ab8K7H3grV7y', 'AkaoT7GlLBRvW3juto', 'YgZJptfrbXVRpy3KeP', 'fl2p0RLB5Q6fsb00V9', 'dLnyQVbCN', 'M451PVmUK', 'aTxp3wESO', 'qjwEvoOSU'
Source: umPJEpnOgL.exe, UwKfROfC5IDUFqHjiHt.cs	High entropy of concatenated method names: 'AYIy8Dk2Wi', 'WBS4p7v7pHMpFtgHVTH', 'jtt0XsvRtUG0xgJ9sfZ', 'r0lN7pvCJ4nJjrd7FXB', 'tUIxEvvt1C5GpfSm6Vk', 'TUxuZpvV1LYcRTnNpMw', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: umPJEpnOgL.exe, V4BFqBpKfNfyH3Rh2tX.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: umPJEpnOgL.exe, Tx5JOpymLjNHGUGSKvd.cs	High entropy of concatenated method names: 'VLphSPwJb5', 'CTkkUuQsZyqswclqc4B', 'qHlblNQogqanPLgOnYo', 'rOVeYFQlfKdlwnjr7as', 'UqTGIsQJh0NoG1DPiGb', 'nI3xSYQNermUTaacRCE', 'GA3hiK0c1p', 'qa2h8viTrJ', 'atZhWxPyS3', 'OSkhbPbrqE'
Source: umPJEpnOgL.exe, nnSFoMfuP3OygGDBapJ.cs	High entropy of concatenated method names: 'md2f4SinNa', 'j5fnPtdAVOD6O6VevbN', 'peNjCLd8sXf6Ku2vY8B', 'l02aeydSefTt88ld5AC', 'N4UqU0dUB8BmimwlNsV', 'spY4o7dC3Z8g0jDTVB2', 'xZEyC0dtUQ0776pTnqV', 'LMkVhhd7BfnIESqKRQp', 'DfqfUq9JUg', 'RCbQpXdm1bElKUiSwsZ'
Source: umPJEpnOgL.exe, XGm9nafGrmCbDr9QcdV.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'bkOcUNRNRcnhj03TRsS', 'jqEL6IRYnb9NgR5f7hG', 'Euu0jfRZU49cjrPy60f', 'o6KPCWR9GgXqPXrkYNc', 'sNTkjfRpCJ0FQ1EQZiJ', 'IWZgu1RBSwGMfd5Tfwo'
Source: umPJEpnOgL.exe, JqmmYh1RRiB3bYbvhvG.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'NjuEiklgOs', '_168', 'O9N2YCh1gD0Mk2vMAlW', 'yTW3wnhFSxnut8J28j2', 'PsYSdRhuT43pYGZLOmZ', 'RVFiQKhwIx4vfYQnfpd', 'gMv3f3hgQFrg2P24Efc'
Source: umPJEpnOgL.exe, SA7gdMpXlJ9gipkvd7P.cs	High entropy of concatenated method names: 'vWGwpifpsB', 'bX8wEofu9s', 'XI8wTErXBl', 'CEqKA6FOLFCY0nGt7R7', 'VQgeMpFIJn5eqKVqHA2', 'YL2m5jFMP3KWOSRf0P0', 'tIIfIJFKi9gO4YHTi4d', 'EoLfSqFQ6GLPrqAqHYj', 'aRrO9tF4hVSl7ILExLH', 'Xf0wK4Fy5yIZchS2l7I'
Source: umPJEpnOgL.exe, biOYRUyiU7NiuM4ZBDE.cs	High entropy of concatenated method names: 'Mqq1zaTKHr', 'Fr9pgjNiT2', 'XBXpf1tYgR', 'Y5xpyZNAeG', 'X9dp1yj4Zw', 'XfRppO5IDU', 'NqHpEjiHtw', 'IULpTii6yM', 'jCLphghINJ', 'Wb7prbtc5n'
Source: umPJEpnOgL.exe, KtX1PLfmQbH18192P8e.cs	High entropy of concatenated method names: 'ySZyo17whD', 'hFeyAwVvY3', 'DTbyqrqhVN', 'mygDLhviugCyaddpo0I', 'nspjsVvmn1jLVnggL8S', 'Rt2MWIvdcaWd2sE8kR8', 'lwFV5gvvtkEeJWCfgqE', 'F3JoeIvWctwXcvWcgJq', 't1XA88vj76DHtbPRqf4', 'tBYixav5WesYMrAVJBg'
Source: umPJEpnOgL.exe, ilEwS7pbuqrgBHUUKlX.cs	High entropy of concatenated method names: 'SiCw2fsoRY', 'cnYwL0UJIW', 'P6hwxpsOfM', 'fSHwVvmnAA', 'M2UweLo1bw', 'SJfZDMFLOKlJe5g3UhP', 'UsSeiqFcll3CalWv7SW', 'An2il1F05j6AWGGo26E', 'RUM4WAFfjN1ljPZ2wp2', 'a0L9SmF2Jki6BWEcJbF'
Source: umPJEpnOgL.exe, t5pfSF1zUQLGTfjDyog.cs	High entropy of concatenated method names: 'eyBOD4BFqB', 'aNfOIyH3Rh', 'FtXO5rfVTa', 'wV2wfXxqZpAh3O9EGvN', 'BYpMAlxEZMPjJoE8iB3', 'PbnVW1xTVlviA2n9D6E', 'qy6aKSxeMkVBfrRBoDU', 'VkpwhPxXrLDNlpDvCis', 'ENoUofxDJIXmbQ9SYDt', 'YvyTkrxHTCLRwHi3gQq'
Source: umPJEpnOgL.exe, F9Zl49yoLwHepYVqWLI.cs	High entropy of concatenated method names: 'QrNpbCwhUb', 'XaepYGFTiu', 'POTpoUXfE9', 'tsEpA6xVeM', 'H1ipq6mKDE', 'wIOlKuKSmo2O9QOwRn8', 'CCyZ8VKU3MIYeEvkqD5', 'wo7xuMMbwqPNhRA89s2', 'FsuY9jMzbMQnG5VOZRF', 'wKila2KAOl1RHPfFDkF'
Source: umPJEpnOgL.exe, MMn2VqTT9T8df4a54cE.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: umPJEpnOgL.exe, TLKei51jBR6BtBlyh1y.cs	High entropy of concatenated method names: 'BTcrN8eL8a', 'BQ2rF76PSy', 'EnFr4QcR5X', 'zmHr6YOUno', 'MRmqpQkfAuv4YlC4ahu', 'UiNEeskLRQKjUoOMLLm', 'I9Qvxmkc5XsYSjkXSus', 'PibAhIkGIcJKH8mfRom', 'iMw9S1k01CKpdySrbMI', 'xl9NZxk2ti5BAPvPCaj'
Source: umPJEpnOgL.exe, RVr1uOeHODFWT52hua.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'qT0gA38cnqMRpMcA08C', 'CLO5yB82wtsrqKA8YF5', 'gwd95s83AQKPLAqWXWn', 'WFKcmq8TtMpxHaAFAtu', 'VXq6i38eoyAeg2C0BGb', 'bEsZib8q7eb4l9SWnHD'
Source: umPJEpnOgL.exe, d1KuVs1nBFGLMwQaFoc.cs	High entropy of concatenated method names: 'WGfrvNL6YT', 'hZKrZl4BXt', 'zTfrBvpRQ9', 'OKUrCZrQd3', 'NBor7bjB2N', 'AchBA7n7KvWGMhTyrmY', 'Q47hYsnRF5YYClip2rc', 'PxuKqpnCA5iyoTHBbtD', 'J2tKgDntVTiZsJICe2j', 'h4t9ignV8lH1jaUgKQu'
Source: umPJEpnOgL.exe, WVPbaLp97FYQXPBLlV3.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'ov5jlSMwHp', 'YBojGM6RmF', 'r8j', 'LS1', '_55S'
Source: umPJEpnOgL.exe, fyftS6TYAgg9SEWttpr.cs	High entropy of concatenated method names: 'uxZPWM6qkx', 'FZPPbV0qh7', 'gFNPYIS8DY', 'jwvPokFgWd', 'hgDPASm0Wb', 'o6Nr74epL8Jp0tr8HPS', 'Lh6YL6eBsuCZcyRYQD5', 'q3jlLuebiV60vyTBoXC', 'uUkTWPezbSc9idhVZY8', 'BB6i3DqSntUTqjO7I3v'
Source: umPJEpnOgL.exe, fKcnufsqq9JUgQIpu7.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'h7RW2ctMIiWhAMM5aYn', 'aFBAkVtK4eacBoJGT60', 'KfjFWbtOjOSEsDrt6OM', 'snIBFWtISicK8IxqNCS', 'Iirb8ntQGDvd2KmPd4y', 'LrplK2t4JaeZdsBeiJS'
Source: umPJEpnOgL.exe, nOkZJifJEChjfbr9Bmk.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'AeE9ndVbhKdkc7iel3J', 'DZQW5hVzoGHcTgBqyqi', 'Nw9jFJmSoBpxENMdHuq', 'Ay80PvmUJciUNItGrtX', 'LEdfe8mAfUbeXATXXvy', 'TC1jeMm88sx4X0snTrP'
Source: umPJEpnOgL.exe, UvIhNL18u0VooL0jgYy.cs	High entropy of concatenated method names: 'I4hcl7IPOl', 'ewScG7uqrg', 'VHUcXUKlXe', 'yDRFcJnXBu5mMCFSRcW', 'kkBqvcnqZ7w8yFQFPIj', 'E4EGTlnEeGkdTTIkXHq', 'YbjLnnnD2mDKe6SZ7IJ', 'UsAcT7gdMl', 'z9gchipkvd', 'XP3croyWV0'
Source: umPJEpnOgL.exe, LZuWjtycyVTIHKYyHHC.cs	High entropy of concatenated method names: 'zHr1Mq8NU1', 'gAs12x1AqB', 'iKH1L1Q1Cd', 'f3o1xEGbqV', 'b1x1VLOLuJ', 'tVr1eaMZcd', 'Qam1d6gAqG', 'fwPmFdjx6XvIRJ5rMEG', 'iCgrlLjrCmsG0RgUb4L', 'YwF0BFjh72SPlhYciXB'
Source: umPJEpnOgL.exe, N8YWoPD2cmkb94V84X.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'jo8jIvAifY1OXSH3j7S', 'zageqUAvjWLLwRPvBda', 'BKogP9AWkiNR0bNtWyZ', 'xOnHQoAjpqkco07pVwu', 'MvMnv9A5CombS6V9nyH', 'UIcLJRAMbdfdGyZ2RJG'
Source: umPJEpnOgL.exe, V3wxBcR1TjmyZAulsB.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'FE3Z8et79o7w8SKnkj1', 'XWhSl8tRsx0gskPj2d6', 'Gv1csRtVaBTprUXQKNP', 'jo5iSjtmQwssiOYREhf', 'mVkeJItdpi2Ib3B9EET', 'IFE5PNtivbDyRgT1ktS'
Source: umPJEpnOgL.exe, hQd3FBpwobjB2N7E4XB.cs	High entropy of concatenated method names: 'J7o0x39PPS', 'LoJ0VlXHyc', 'z2j0ecJiOM', 'fwG0d3R1P4', 'o4h0kf9Po9', 'hR7faD1b4Ff2dXWaumF', 'tw71Jo1zpcuvgoX8RG3', 'blf0t01pTavNQkG0Agc', 'De7M061B0eh7swwsZRo', 'eUraOKFSwkm67G6hgwq'
Source: umPJEpnOgL.exe, KBGwC3ffpyuyOHFjhNA.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'OqbAdK74vRXobUF3F8m', 'B2lddv7yxrP4FO63fX3', 'HR6X8y7kJlPpxLhtCT4', 'OufZCI7npai299sENZ6', 'LffRIL7rTPIMxdYOQCI', 'EXCynb7hT1gOEZ7dd4S'
Source: umPJEpnOgL.exe, gRbk1UpNq8wZHbdFRH8.cs	High entropy of concatenated method names: 'Ex0vKUul6n7rm64Kfho', 'YUbJRNuskwkjbXth78X', 'M8GetIuPIPaiSEkco15', 'ALDn1Juodfp7NEjPlRO', 'FHBDHFuJQ799YMltYFL'
Source: umPJEpnOgL.exe, PXkxmnTHjEhg1W0J3Z2.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'h5AJSJoQnK', 'lhkJPXSlsT', 'YhKJJx2w6g', 'e9RJDaOhxD', 'WXsJIIGUIO', 'WV0J5S8dGs', 'BXe39tE2MEabe0X9W1N'
Source: umPJEpnOgL.exe, r3vkmeELf4AEcFgK8Ub.cs	High entropy of concatenated method names: 'IRySgSR6HH', 'VrYhBG2pYinfOT7vjTq', 'mAqdGO2ZLotwVkoSsll', 'HIMhn029j7u3lqhG3kT', 'EJ3DjZ2BfAFfuKgwADx', 'u254FF2bN59XCxtLmis', 'qrfNh92zWNwH4QuF1r0'
Source: umPJEpnOgL.exe, Kgy4mJEv9Ja9Fdxl52D.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: umPJEpnOgL.exe, PJBeqrEMjreMT8in4Vg.cs	High entropy of concatenated method names: 'MONqvgS2tx', 'JZQqZ0VoEU', 'Bb8qBCBApy', 'EqwqCTxxdf', 'qbJq7pUX1R', 'uN2qKkFmCH', 'Ju9GBm2oyK4noyxeXRO', 'j8rxpI2H3HrLuInZlAH', 'nP0BXs2PV1GdLyi04G2', 'vrKcLG2l2tf8RkLB3Wd'
Source: umPJEpnOgL.exe, UexFmq1GImhopNAlLaN.cs	High entropy of concatenated method names: 'mjurRVdxtn', 'rIRr9Hgi7c', 'TWhrstBuXI', 'lq9YOWkHig8mgekZ67U', 'u6YXXHkPLKdM79Tls5y', 'Tj1mBWko4JXy9GOt2KW', 'utU2Adkl8DvgdSvBht6', 'XkeWcmksAUF70Eb99oI', 'OOc5PxkJqO5OXkQy7Rj', 'pmLwDgkNJ2jijd66PLP'
Source: umPJEpnOgL.exe, tXR65KfYv42W2pB4kgr.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'XNopkDVxwdqDQo8ANlA', 'w0Fu8dV1ckHmHpMhkb0', 'chmDGYVFyW38qSMwpkS', 'aTPoAfVu3RALjkS98Vc', 'nihbyaVwR5YfU63VLcd', 'eHQI72VgwgM5Il4bfcg'
Source: umPJEpnOgL.exe, BFbpmdf1s4OQi5yaj3Y.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'WCvKgr763oTLJjWPLV9', 'XerneR7awAMgCDiF6Qa', 'Cok7kb7GTQrdRHt4OaK', 'VtBf4T70N5Gogm6FZdZ', 'a2m42H7fIcojyuXRF3a', 'mYE7BZ7Ly6Y9rpRauop'
Source: umPJEpnOgL.exe, acivnhpCXhUWLm5Jf1Z.cs	High entropy of concatenated method names: 'sQylSgvPH9', 'vsElJ32DPF', 'vnylaxTkqk', 'IKeljgu5KG', 'OrHllJvDUZ', 'srnlG2G1ZJ', 'j8vlXgGbra', 'GiSln3Uy8m', 'a5Eli5sggJ', 'UPdl8huSPk'
Source: umPJEpnOgL.exe, NmgNVf2hVQthJVLLgA.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'UNXNPx89m', 'RqUBpgALft5r0tk3hmi', 'yOH6ucAcQDl66j71Yqm', 'yetlVjA2y8DAHXbf1mv', 'hnmJlvA37tkgpmID4gK', 'jy8oauAT0BiHxlVtTA1'
Source: umPJEpnOgL.exe, SmUwAQpEt2uBvTLoj8y.cs	High entropy of concatenated method names: 'wmU0XCsZ1D', 'DAQyHO1QQYGMJe9piNn', 'JDn1i314cqvFk3P2WYK', 'oTxX3b1OP4gb7nqgTNh', 'd8WoJX1I4fMj5pcFaO7', 'rQtOuuStSD', 'br7OH4DnHy', 'VAUOMsaDYn', 'J6SO2ZxSlH', 'Aj2OLRN46h'
Source: umPJEpnOgL.exe, piJf9STytgFLXxvaRft.cs	High entropy of concatenated method names: 'hNTPrG4AIa', 'lwGPcwLGLp', '_8r1', 'pslPOdyllj', 'xOnPQQE8bW', 'hnEP0nUaS2', 'kVvPwjdptp', 'dQxuRneKBf5KPge3kFN', 'tIqaDNeO8UJYUJ1TqCU', 'p1r6EDeIJjRJgbpmuUN'
Source: umPJEpnOgL.exe, Epe3mnfEEUrF4MoJNK2.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'dk2D7c7HkAmFAHGeeyx', 'XCWuV07Phf62RLmVAJJ', 'KMWX6W7oOuapFutIDVM', 'm9pXuS7lq4H6Sa60Tgv', 'YtovWQ7si8lpxFiEmYY', 'f7YX0n7JJruBauG5Tfi'
Source: umPJEpnOgL.exe, UKKdkuf8oRGtiNYmIRF.cs	High entropy of concatenated method names: 'Dwbf590FET', 'PNieBqVIkO6iQqMhw3o', 'vmhvvCVQhTyMuwlQ0V9', 'PJI6TiVKHu6OAYh9EM5', 'kddDwgVOSkQgMZCrDIC', 'CioXSNV4YKW2OFGEE92', 'vpaU2kVyPaIijP3dl4G', 'TTfekbVk2NHoh1MjE6P', 'XgrL7QVnyvpD4VHdpwL', 'f28'
Source: umPJEpnOgL.exe, aotRNVfsK51ar49KsGF.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'HLKibOiG1PHDLhCkZAu', 'b5hYAli0kKoe7UhJ5yk', 'CZFLNlifVxqlKDuyTdS', 'TjPJ6miLBMuZCSAAikp', 'V0dnW0icj8ysYJjp5xr', 'cEy1Pni2QWIiwpiQCYC'
Source: umPJEpnOgL.exe, Ma342Z1tgvxRlvyZhwX.cs	High entropy of concatenated method names: 'sg9', 'A4fEJCZCNE', 'otycKlZMOa', 'TxvE40Fqo3', 'X1I4Bjroi48C2BpLQbp', 'g6386Prl0TiQ1XHl0uK', 'mqgLw2rsVTZMJgs0pQ0', 'r4X7XurH8iiGVMHMMb2', 'VCyFKTrPn2fofnyf149', 'fGRMwYrJybm3iIC1OHD'
Source: umPJEpnOgL.exe, TJQsLHyjvcKebRGnEum.cs	High entropy of concatenated method names: 'osg1CotRNV', 'YjoebY58cDkLW43x0a4', 'FqTsOi5CB3g8yObIaVN', 'xMZM4e5URuH1gIweybS', 'HNtEs65A5yseA7J8M5G', 'tlNCtH5tbN5s0nb3g0F', 'eTbAsZ57BMwUHfOxWcn', 'C4YAIW5Rqaog3pMoxgB', 'lraols5VA4qeS7K3fyh', 'nu7Xpt5m80OkS1260XY'
Source: umPJEpnOgL.exe, HkQYdKHGwtYaxiCxyj.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'PBukybAct', 'qjiwtvA4xPCs1EMHNU1', 'KjibOIAy0KHRk6QPM3l', 'vA1HeiAkutbPWerkFoE', 'vfyDItAnuUH7mMsTZbV', 'iEahsZArKWoctud1hAV'
Source: umPJEpnOgL.exe, HrG4OAyXD0f0IRIZdhi.cs	High entropy of concatenated method names: 'TGF1KA9Jdv', 'j2i1mIQ6uR', 'GApnNn54C7WXweA2Zcx', 'stlxpg5yqm6ABch9Ttk', 'qTvH8K5k0YGKF0voTi8', 'xYLoLm5nka9n7GX9rLs', 'oU5Hx95rkqRomOdUwjZ', 'bjIaqO5h4QfKLNIpAP9', 'WMiRd85xNLxaZNBlFd6', 's39L3R51VDEUIKTuaxb'
Source: umPJEpnOgL.exe, K2WiAafhqN7NoS8lDQn.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'ul9QcE7Zrnl56aVpUyx', 'o2c2pe791KrT9o6RPE1', 'oBWZPM7pZBXctLVje1X', 'Dg9GiW7B4WWO6X68heA', 'lXmSpv7bMMTGsKV8Fsb', 'A3Kpby7zF7WWbS1JbMN'
Source: umPJEpnOgL.exe, AKncdZ1qJyZKbTs91IK.cs	High entropy of concatenated method names: 'NHWcMd6u78', 'ivEc2BRtGT', 'CQSoA3rQht6WpgIlrnW', 'RMBHB2r4o2TJyKZtbtD', 'mw5ZUhrOobHsm35c8ty', 'HNG441rIt6356g2kqQi', 'AsYiX9ryYmuEW4E5UxE', 'RHeH6nrkbRN44shye90'
Source: umPJEpnOgL.exe, Qi9Qqso22RnhNGi9xl.cs	High entropy of concatenated method names: 'J9Dqq2upB', 'xHBSK0BxS', 'BtuPyrt2V', 'RgQJowM9X', 'gvID83TKd', 'q9ZI9j148', 'q8y5qNu4U', 'Fp7bNLUVnylaTNGNWdL', 'vk9cl1Umy9spIjdlmhR', 'eX03vbUdiRKt27TEXQF'
Source: umPJEpnOgL.exe, IMVlaHfS1LnsJ8KIAvD.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'bBgPycVP1lySBO1Fx7Y', 'VNedbRVoJll7spvbWCs', 'CSyhD6VlEG66lq4e7uh', 'kqRMWvVsoHxhTc4xR73', 'B2lgXJVJ070MQLFEsmK', 'HssaBaVNciV0mImwbkD'
Source: umPJEpnOgL.exe, RaaK50yWik1KCI2c8li.cs	High entropy of concatenated method names: 'UUipar99P6', 'AcDpjE24sK', 'fPcxxkMxJx4g3NDjqcf', 'F6S1rkM1jEg64CSN8yr', 'nmCDsKMrLg1vduHQnV1', 'Jyne88MhYPMwsaQ4PXn', 'w39cbcMFprVEoo7UZQm', 'Mh4l4MMuw2Pda72IxUG', 'fdaSlRMwC8fr9pHYUaq', 'nmV9rBMgb7fXpXTVdDd'
Source: umPJEpnOgL.exe, N8BceuT9jMwW0mrlWII.cs	High entropy of concatenated method names: 'SMY5oQ79Fi', '_1kO', '_9v4', '_294', 'oaa5AO9eh3', 'euj', 'Tx85qDleh3', 'wSH5S1jdH7', 'o87', 'XFR5PAS5Ey'
Source: umPJEpnOgL.exe, OP1DkCE7rnFP4KjDiqV.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'BNGSAE8riA', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: umPJEpnOgL.exe, gbjKqrTFSG4FUyLKsdI.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'oZ15c6Nfox', 'hCo5OURIlx', 'pbe5QPpLwX', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: umPJEpnOgL.exe, VKtNDXpJtOGmHfLtjnV.cs	High entropy of concatenated method names: 'aSqa29sq35', 'JSMaLhmd33', 'dQJaxYGa6W', 'QAdaVju7Mi', 'V8Pae0KPyE', 'RM3Zvmu4VxCSj4lHEMe', 'XEZLPRuIXnqFGXPwWRk', 'F9paYjuQ3lOSG4jB5TR', 'Gyw1uvuywUoOxNF3iRK', 'kBh8ZyukvN8JZU6Ngf3'
Source: umPJEpnOgL.exe, SRrGrafnFa2uH6dwcpY.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'Iy8xERVS972sipjgo1U', 'bXxkUVVUBFs4rOdorin', 'Uo9aGeVAHURcqhTRyO3', 'DV5eQPV8DmDZC8tHFue', 'j3TPPjVCsRlGNsmrfmH', 'sSjGXBVt8jxw6EaIrnP'
Source: umPJEpnOgL.exe, SEoC58feBxkxlZdpMQA.cs	High entropy of concatenated method names: 'QGCfK7VsNU', 'qb8vA2d2kFEYsGbdheO', 'Q90bGJd3ewQ36WeePjp', 'rfADwVdLlZ2BeGRmSJT', 'lJ5O3HdcnbxyOJyU06t', 'vZLsLHdThJlh9Ualb5S', '_3Xh', 'YZ8', '_123', 'G9C'
Source: umPJEpnOgL.exe, DoBEogZV3Wauo4piqL.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'h1AgkStw6nTLGJfZUr6', 'aCiaDrtgKVMYABoZpa2', 'vBOWnNt6FgUDZ0ViG2K', 'rfkL9ctaLC9QQf7vyTh', 'rMSGArtG12hUircmDM8', 'M3Cik7t0naPSukFLCGM'
Source: umPJEpnOgL.exe, VYlyaIKxGSWfTxtouP.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'zjN8BMtYWqS281N5Yjr', 'NAeFUytZoZI1684jRxU', 'AMPtUjt9AZwDtkSmhvO', 'Qq2ajqtp29w2jTqWrBh', 'HpuDaktBFNZqwLBRvlX', 'OKQtUDtbPKdLuMk42GV'
Source: umPJEpnOgL.exe, BWEmpMpqfQDdrtsAYCF.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'yBIag9LnYy', '_3il', 'BDiaflN7T4', 'IKMayca3NE', '_78N', 'z3K'
Source: umPJEpnOgL.exe, UFT96MFlFM1YppF90Q.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'DAjLbdCI1nIVrIq1M1b', 'WUYUjHCQCwKKRpQVV8g', 'lcxEaNC4Or1gKucvmpG', 'gh0REXCyd39Yf7buVSG', 'PRnNcsCk1vWCZ25RgEy', 'QOEl12CnWaKZUrbi0mU'
Source: umPJEpnOgL.exe, DgAiXF1FbXNWQykHjuK.cs	High entropy of concatenated method names: '_5u9', 'lI1EVcqO2D', 'HiBOgHLfmp', 'WfcEanB4Tb', 'mbdHUPrpqvr9qCaeP6Z', 'NGD6K1rB7NBIkkbM7oj', 'vlXLVCrba0ZMvIhPXw2', 'NuRpmgrZOi0IKSddkLm', 'oD4fIOr9EBFwpdW6acC', 'n7ktsTrztx8XNeFbrJJ'
Source: umPJEpnOgL.exe, NqJNpNTJlrYB4rcdoqy.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: umPJEpnOgL.exe, smVVECfQkuu6ey3LWeV.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'VOFCAIR4oD20f5jOWqX', 'tYB4UhRy4ZZMPfunq05', 'zuXmg0RkV9nUZraCr0Z', 'tLFP67RncF3covjyg8i', 'CacHXjRrfgrdUUljieJ', 'LavHG5RhMF5eiT8kvey'
Source: umPJEpnOgL.exe, XHPvrbCioRGC7VsNUA.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'N1S0VdtDRFFGs83fBNW', 'T6M9U7tHJ7nPPQaZAFf', 'rIOZSvtPA4XG26ZIrsi', 'o8yQiktoTcDKA5ddo6H', 'hWm1sItltr4IadwlRML', 'aWAtI7tsEBMJvWah50w'
Source: umPJEpnOgL.exe, ypZtTlEuqffPseKGEdo.cs	High entropy of concatenated method names: 'xQkqUMssMC', 'n7dqRLgPgu', 'X9Gq9ICDO3', 'NjhQAT2eTbTYNeHwQiD', 'Cy9X2X23TjwAVr1BA1r', 'kdlkXw2T4urnEqR480J', 'FRtDiG2qPTMnSujnpTL', 'Glkjkl2EY3sUEW8pEHV', 'c0wrgU2XQNfikeQu1ix', 'g3pYic2DuLvevGY6ibu'
Source: umPJEpnOgL.exe, j7JUa8pZJTuYo9a9XwX.cs	High entropy of concatenated method names: 'OKojKc2P1b', 'QqsjLrRTGO', 'yvfjxtReJG', 'GNtjVVtAaf', 'oHQjednYQB', 'BBejd4T7H2', 'NRcjknrSb7', 'skUj37ZrOB', 'FvqjtWM865', 'E6XjNYpvkH'
Source: umPJEpnOgL.exe, fKHr2rfZ9jNiT2KBX1t.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'eK2ayrilKI3OyBp0AZv', 'FH42qQistOTlGZOFnbW', 'Q6HafuiJuPrb1XxEHUk', 'Dvp0m5iNZ3cTtpUV4Fw', 'cJ2VOEiYdPDY4EQo8Be', 'pe0famiZZo83f0aMkgL'
Source: umPJEpnOgL.exe, wyBItNfA1dLtUM25mDF.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'deCki2VLGdEGmAlsaUh', 'K0uyDZVcVJg9Od433fm', 'RUGMZmV2wOmhhs4kblj', 'Iq0JG2V3OlfYSDZw8e5', 'RB4wbnVTGnapplst1e5', 'ei0h3sVewJgeVtajaKj'
Source: umPJEpnOgL.exe, ts5r7xhQLDvjlqlv5SM.cs	High entropy of concatenated method names: 'k7ZOw8VVoa9GR', 'KHXoI5HMragENyHoA4e', 'njwtDvHKKYs96MiJQtw', 'ntwfKtHOaXVuTnG9qtx', 'Fsu0QpHID2KG76EXAE9', 'yrTKIkHQ6aodqZsjXGD', 'sbc7YaHjFwd5cwAMpo3', 'HdV5TpH5pjv1JLw73MT', 'AOOlQXH4jSlKVH5xKEi', 'CPMgQiHyPHQcaIiuksY'
Source: umPJEpnOgL.exe, tdgGbmfjJfvqaSI3G1s.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'r6XcmpRT1T2tWTaGiyG', 'FpQVAoRe8YEKBwGpy6e', 'CBHlghRqsPaC59Hch3v', 'Mq2EGTRE5u9sCAvxnoY', 'pcm2SoRXNNQpyjQuHV6', 'LWesgNRDZqfFO3GglP6'
Source: umPJEpnOgL.exe, fky75XfLO6ZOSULkFvU.cs	High entropy of concatenated method names: 'Do4fZpiqLi', 'FCYIeudxZmEOyUTEjQ0', 'smQcI0d1hhxTxfZ7g5D', 'oOnhCJdrA5OJ5Iw7WGW', 'CyFU1ydhfScS7uqZvCi', 'bcZMiVdFR2MQYn16wj2', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: umPJEpnOgL.exe, b2kpdpTgPOukbOj59eG.cs	High entropy of concatenated method names: 'f2iS4coYRM', 'acQS6VQaEk', 'kp0SUevri9', 'YHcSRxcLpa', 'pGYS9PZT9X', 'LnMSsIYAs6', '_838', 'vVb', 'g24', '_9oL'
Source: umPJEpnOgL.exe, AXKKadk1q0Q9qK7ChB.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'gc5ED389SnWtJR8G8gd', 'ussk5r8penna3UeWdVE', 'nK5jKw8BFutvADHcHql', 'LtX6fA8b0L4lTwkx8qm', 'kLRjG28zh788nTGdTxA', 'WupdtaCScTR1FxVRlvl'
Source: umPJEpnOgL.exe, EkhvAjpipJY325iuR4B.cs	High entropy of concatenated method names: '_7zt', 'hovw88HJIv', 'VOdwW3rZUn', 'PxOwbpyjfh', 'UR3wYwvoPW', 'BOuwoV64g5', 'uUCwARnS15', 'AGy0l8FrlVILjc7krSF', 'BBP0rYFhhRAvWCefq1Z', 'cfyAECFkTdpfQBewbKo'
Source: umPJEpnOgL.exe, miElsyEc8j6VwyWXdMc.cs	High entropy of concatenated method names: 'xkaqWeClvL', 'Nf5qbdAjvu', 'TlbStGcY0Lv83A8Sd7D', 'U23eXQcZ8KfX0Kc9cSM', 'RI9SiUc9CUh7Z2nqs8f', 'Fvc5g6cpVJCvlEHqmqa', 'eCWOr6cBMkQSwq6woRJ', 'ToUXtCcbdxSMN9crKrC', 'jlB2dgczXK5uTSPXGB1', 'Se7DwF2SDweSnuUVuGk'
Source: umPJEpnOgL.exe, KOy5I5yIyH7NDmH30R9.cs	High entropy of concatenated method names: 'TUIpK8jaSR', 'WsKpmPyu45', 'p9apzaK50i', 'K1KEgCI2c8', 'niVEfa0e0a', 'rVhEyMmE2Y', 'k8CE1A7gEj', 'zBTEpWJpWs', 'u0ZEEsL9Zl', 'JabklxKZvf1JNttin7x'
Source: umPJEpnOgL.exe, vKTGOnfIvGXPkN2IGaT.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'EDeQWZmc0Rh0L5Ia5t1', 'g5DfZEm268Qp7u0tlo7', 'IgLmKrm3oFdF5RCjxNL', 'bD2MORmTGrScciLx7wC', 'PRVjvMmeKjnGh6r0J1I', 'nx4rsCmqT3k4u09YgUs'
Source: umPJEpnOgL.exe, gtBuXIpQCGfNL6YTrZK.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: umPJEpnOgL.exe, Bo4XrUPxVctoMfc4vI.cs	High entropy of concatenated method names: 'frFLfBymL', 'iwQxbXLjq', 'QWQVd8SBk', 'd9Qoe2U3kFl1cnsjCZH', 'H6UgJrUcGcq3UkAZVAY', 'I08I11U2YeBEX0xSsoD', 'wbVTnFUT0JWOkgm8TD8', 'REZNxxUedG5dCCFKuK0', 'IkIVXmUqk6Ywvj1AQaq', 'aPJHITUELrfs5UGQ8Hd'
Source: umPJEpnOgL.exe, zIW66hTApsOfMTSHvmn.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'u6qPqZdM3d', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: umPJEpnOgL.exe, ArulynE11YcLFvIkZtn.cs	High entropy of concatenated method names: 'bwjHMo0rNwssDwV3VKV', 'lxF5e60hVBKtP2QBquA', 'X4whqM0kSV5YRPrgJwL', 'GyYyiR0nSplc2aR98bf', 'E1BWq9LNlV', 'UrPEih0FRm8TmyELs0A', 'E00bjf0utrQEHEnV88f', 'QAuPtS0xF85UNdNdxfc', 'CP2efP01B4CKKRSMXEo', 'j1qP3t0w5RDVY45oEfA'
Source: umPJEpnOgL.exe, xW4UwmhSNt1FRdYMOlk.cs	High entropy of concatenated method names: 'DCtHq6VF1k', 'twZHS7CXW6', 'b1lHPMqQXW', 'KkIHJlBXLS', 'hMHHDCHFCS', 'vKNHIkDrq1', 'cVAH5eDp9l', 'Mn9HujAjAW', 'inlHHlJjMR', 'VmcHMq89tr'
Source: umPJEpnOgL.exe, yBI9LnT2YyIDilN7T4e.cs	High entropy of concatenated method names: 'nwDw6pXC48IDrVV0tMI', 'pX3QnnXtlFBLIZ6xAvg', 'EGmpbRXAgJxjGH7bSDM', 'YdBssCX8drDNh3lWVIf', 'SuDJLsmP4x', 'WM4', '_499', 'MjDJxjBTpo', 'OtTJV62GFJ', 'kCOJeIfwTl'
Source: umPJEpnOgL.exe, m83OEK16a6xFSsRRYSu.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'eSDELBLoNN', 'K1UOpq8wZH', 'nWXEj70fEo', 'zsr38chjMdYcPyqO56H', 'mo5Sqoh5D2h61hPscVP', 'lAqjrnhM4B03I3bfvZ3', 'nny9s6hKwhNgmDJEDEK', 'sJ4vP9hOo7V1sFd7oLE'
Source: umPJEpnOgL.exe, XH1Q1Cf3dT3oEGbqVf1.cs	High entropy of concatenated method names: 'HGSyfWfTxt', 'vuPyyoZAMs', 'cQOy1Tvy2K', 'BmhhU6dJrPXjl87N1rS', 'O4c6eGdNhURdFMhFhJl', 'Y3qp5pdlMdaiMdc5aLN', 'mrc9KtdsIA5jgQmnc1V', 'J9gU5FdYaIHbnaWb2TT', 'xj0KjDdZTrXXpZoSxbw', 'k4f7sud9E76gYclRcoB'
Source: umPJEpnOgL.exe, U7LNi66U9folMbRuMy.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'KALjs9CXUJYXx9HnpTk', 'wYxm1WCDaRwfUt8kJhC', 'D5vP09CHe4PmP9dukEO', 'ypA4gRCPOjTLutbYaDl', 'apGpe0Co9uUrijV8x0R', 'I9BVrPClWF7KueZxPho'
Source: umPJEpnOgL.exe, NjkD0h1swZrBNu2OiiP.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'YEhOQvvhoA', 'l9uEuDJGlr', 'ffRO0RckOd', 'xsCER69nJZ', 'FEQIAAh348QSMUkHohM', 'OF3rcGhTXD0bVF3sBq4', 'E1UdNZhcKbrqgAq8Kat'
Source: umPJEpnOgL.exe, XfKuPJ1wZPxtDLivISX.cs	High entropy of concatenated method names: '_223', 'zgQXCNkIc3LPnVQtkie', 'hvRQQwkQ5fqDlKAkBGA', 'U5uBMLk4F1B8s6E6Uak', 'QMGwMGky8TMhRVoUeUx', 'O6bTMQkkC5XsWy6hEPh', 'FVVoWlknxFyvW9JjgpJ', 'NLQs4mkr4tkHbuE4itk', 'IH3rJPkhiHTlKWpptf5', 'W6hKwZkxtm73ejtfqrI'
Source: umPJEpnOgL.exe, h99P6IygcDE24sKA636.cs	High entropy of concatenated method names: 'adSySAWmRC', 'Y58yPvnE87', 'smVyJVECku', 'Gmgs5Mv0axAIbV70OPR', 'NKCOX2vfh7GYSVRTJFd', 'blwMWrvLps9XNrBeSn9', 'hNc21rvcLJsO4c013qa', 'FWBu4bv2sHSdn61V0qd', 'upxZ1vv3aMobuLPe7t2', 'S30tuPvacVpVWUZgfS6'
Source: umPJEpnOgL.exe, z11wYR1fAYMlH9elp78.cs	High entropy of concatenated method names: 'duDh5er7nE', 'm8Nhui7bBq', 'hjbhHyLUba', 'EFhhMdoblt', 'TEBu4DQzm2EVtFKoQ35', 'd7nORkQBEU8pDZGKR1E', 'PHE0yMQb4lyFcPWorHp', 'Ck7Lm04S1xUGNaGGyUe', 'hRI2sj4UXA0QMuYwMR1', 'zlda5u4ALFmBtAcUGB7'
Source: umPJEpnOgL.exe, zmHYOUpcno4cqCeMHga.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: umPJEpnOgL.exe, ckqOVSykr6Lm4tWSabt.cs	High entropy of concatenated method names: 'UywTrhbRww', 'IEgTccJ6Jl', 'yF5UyPIZsYcg74MmVHQ', 'C1Fnh6I9InWw7rjvNH2', 'mOhUF7INYcLB0wf8b6A', 'DrC3jDIY8aaRcWT3NfG', 'H5JTXOpLjN', 'ixWpNWQSSRMA5r0YeRK', 'h6BUuAQUB4xpL1LDneK', 'zMnVm3IbKGcWRsvxUZh'
Source: umPJEpnOgL.exe, HdwMowzcpx2CuIrePv.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'tYHq947854fl8NuQNMx', 'TWw4g17CyYngBWI3NjV', 'zKADxl7tuZjFlOqN2KU', 'NXt4AA77OlMrgEyjAsX', 'pNWRNB7RHufIfluZVSg', 't3pUuO7Vh63SPqJwdBU'
Source: umPJEpnOgL.exe, YmxUPPEB5wwGaAh6Fir.cs	High entropy of concatenated method names: 'XVhSp52Lpf', 'EaqSEjxH3v', 'tODSTy6oN4', 'lIOSh5bBh7', 'UfXSrrhuVH', 'aw8ScaGix5', 'U1SSO406ek', 'IaMSQJQIda', 'judS0XRd6E', 'GWcSwe04Dd'
Source: umPJEpnOgL.exe, ySWWsyf6A4sj9WfdTxE.cs	High entropy of concatenated method names: 'p6RyQTYmF1', 'nD0y094x2J', 'G86IZEivK2kMF30IoU6', 'rZXt5sidWDKwvtxRfWL', 'hboFgpii97f6EhADsDK', 'LGkGHkiWnOQxXEOwM2Y', 'cdlA7cijy0Boqht7KoH', 'qNUEAXi5gO4soudL7qy', 'fqYIQ9iMw4SYMMMHr4r', 'GVqpXmiK5NOc74i9VdY'
Source: umPJEpnOgL.exe, Cb8214TSuB1VdpMkSV3.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: umPJEpnOgL.exe, NrwOFCfRckVyTI87jcF.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'JJavHoikwXKgc4rBvsU', 'l2fpklincREEFpH59vL', 'Lq6c2rirIj3laYWn67V', 'CJXs2bihIJmnMxcp54g', 'NRCfseixAaUUIoJLblv', 'BP08fVi1gvahJIveOHd'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\SystemTemp\smss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Users\Default\explorer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Recovery\services.exe	Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

File written: C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe

Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\en-GB\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\ProgramData\SoftwareDistribution\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\SystemTemp\smss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\LiveKernelReports\sihost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Users\Default\explorer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\Tasks\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Recovery\services.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to dropped file

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe			Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\ProgramData\SoftwareDistribution\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe			Jump to dropped file

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

File created: C:\Users\Default\explorer.exe

Jump to dropped file

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\en-GB\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\SystemTemp\smss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\LiveKernelReports\sihost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File created: C:\Windows\Tasks\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

File created: C:\Users\Default\explorer.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe'" /f

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

File created: C:\Windows\Tasks\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe

Jump to behavior

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Memory allocated: 2490000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Memory allocated: 1A4E0000 memory reserve \| memory write watch
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Memory allocated: 1160000 memory reserve \| memory write watch
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Memory allocated: 1AF40000 memory reserve \| memory write watch
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Memory allocated: CA0000 memory reserve \| memory write watch
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Memory allocated: 1A7F0000 memory reserve \| memory write watch
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Memory allocated: 2470000 memory reserve \| memory write watch
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Memory allocated: 1A670000 memory reserve \| memory write watch
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Memory allocated: B20000 memory reserve \| memory write watch
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Memory allocated: 1A610000 memory reserve \| memory write watch
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Memory allocated: C40000 memory reserve \| memory write watch
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Memory allocated: 1A950000 memory reserve \| memory write watch
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Memory allocated: B30000 memory reserve \| memory write watch
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Memory allocated: 1A940000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Window / User API: threadDelayed 1086
Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Window / User API: threadDelayed 854
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Window / User API: threadDelayed 364
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Window / User API: threadDelayed 368
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Window / User API: threadDelayed 368
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Window / User API: threadDelayed 364
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Window / User API: threadDelayed 368
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Window / User API: threadDelayed 351

Source: C:\Users\user\Desktop\umPJEpnOgL.exe TID: 6688	Thread sleep count: 1086 > 30
Source: C:\Users\user\Desktop\umPJEpnOgL.exe TID: 6688	Thread sleep count: 854 > 30
Source: C:\Users\user\Desktop\umPJEpnOgL.exe TID: 6592	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe TID: 4076	Thread sleep count: 364 > 30
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe TID: 7008	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe TID: 3688	Thread sleep count: 368 > 30
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe TID: 6924	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe TID: 3428	Thread sleep count: 368 > 30
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe TID: 7096	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe TID: 3844	Thread sleep count: 364 > 30
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe TID: 6832	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe TID: 1136	Thread sleep count: 368 > 30
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe TID: 7120	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe TID: 7196	Thread sleep count: 351 > 30
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe TID: 6804	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Thread delayed: delay time: 922337203685477

Source: umPJEpnOgL.exe, 00000000.00000002.1780474618.000000001B70B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: umPJEpnOgL.exe, 00000000.00000002.1780474618.000000001B70B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: umPJEpnOgL.exe, 00000000.00000002.1780968289.000000001B85D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}5

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Process token adjusted: Debug
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process token adjusted: Debug
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Process token adjusted: Debug
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process token adjusted: Debug
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Process token adjusted: Debug
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process token adjusted: Debug
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

Process created: unknown unknown

Source: C:\Users\user\Desktop\umPJEpnOgL.exe	Queries volume information: C:\Users\user\Desktop\umPJEpnOgL.exe VolumeInformation
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Queries volume information: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe VolumeInformation
Source: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	Queries volume information: C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe VolumeInformation
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Queries volume information: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe VolumeInformation
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	Queries volume information: C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe VolumeInformation
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Queries volume information: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe VolumeInformation
Source: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	Queries volume information: C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe VolumeInformation

Source: C:\Users\user\Desktop\umPJEpnOgL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000010.00000002.1843698850.0000000002838000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1845475045.0000000002F88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1777428806.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1848659851.00000000026B8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1845832491.0000000002657000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1847435406.0000000002951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1847435406.0000000002998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1849515045.0000000002988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1777428806.00000000029D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1845475045.0000000002F55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1843698850.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1845832491.0000000002625000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1848659851.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1849515045.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: umPJEpnOgL.exe PID: 6520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe PID: 6224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe PID: 2496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: System.exe PID: 6204, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: System.exe PID: 6492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 6780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 6852, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000010.00000002.1843698850.0000000002838000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1845475045.0000000002F88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1777428806.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1848659851.00000000026B8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1845832491.0000000002657000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1847435406.0000000002951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1847435406.0000000002998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1849515045.0000000002988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1777428806.00000000029D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1845475045.0000000002F55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1843698850.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1845832491.0000000002625000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1848659851.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1849515045.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: umPJEpnOgL.exe PID: 6520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe PID: 6224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe PID: 2496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: System.exe PID: 6204, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: System.exe PID: 6492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 6780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 6852, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	11 Scheduled Task/Job	11 Process Injection	433 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Scheduled Task/Job	1 DLL Side-Loading	11 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
umPJEpnOgL.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
umPJEpnOgL.exe	100%	Avira	HEUR/AGEN.1323984
umPJEpnOgL.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SystemTemp\smss.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\Default\explorer.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe	100%	Avira	HEUR/AGEN.1323984
C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Avira	HEUR/AGEN.1323984
C:\Recovery\services.exe	100%	Avira	HEUR/AGEN.1323984
C:\Windows\LiveKernelReports\sihost.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Avira	HEUR/AGEN.1323984
C:\Windows\SystemTemp\smss.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Joe Sandbox ML
C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe	100%	Joe Sandbox ML
C:\Users\Default\explorer.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe	100%	Joe Sandbox ML
C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Joe Sandbox ML
C:\Recovery\services.exe	100%	Joe Sandbox ML
C:\Windows\LiveKernelReports\sihost.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\ProgramData\SoftwareDistribution\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\services.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\explorer.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\LiveKernelReports\sihost.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\SystemTemp\smss.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\Tasks\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\en-GB\RuntimeBroker.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://a0994587.xsph.ru/@=QzNzYzMiFGN	100%	Avira URL Cloud	phishing

Name	Malicious	Antivirus Detection	Reputation
http://a0994587.xsph.ru/@=QzNzYzMiFGN	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	umPJEpnOgL.exe, 00000000.00000002.1777428806.00000000029D3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1463289
Start date and time:	2024-06-26 23:51:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	umPJEpnOgL.exe renamed because original name is a hash value
Original Sample Name:	57a49a947bf36386839f2691a692b329.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@35/49@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 83% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe, PID 2496 because it is empty
Execution Graph export aborted for target DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe, PID 6224 because it is empty
Execution Graph export aborted for target System.exe, PID 6204 because it is empty
Execution Graph export aborted for target System.exe, PID 6492 because it is empty
Execution Graph export aborted for target umPJEpnOgL.exe, PID 6520 because it is empty
Execution Graph export aborted for target winlogon.exe, PID 6780 because it is empty
Execution Graph export aborted for target winlogon.exe, PID 6852 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: umPJEpnOgL.exe

Simulations

Behavior and APIs

Time	Type	Description
22:52:03	Task Scheduler	Run new task: DLNpvJWaIHlCSYcBbohUXVmmYadyUp path: "C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe"
22:52:03	Task Scheduler	Run new task: DLNpvJWaIHlCSYcBbohUXVmmYadyUpD path: "C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe"
22:52:04	Task Scheduler	Run new task: System path: "C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe"
22:52:04	Task Scheduler	Run new task: SystemS path: "C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe"
22:52:04	Task Scheduler	Run new task: winlogon path: "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
22:52:04	Task Scheduler	Run new task: winlogonw path: "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
22:52:06	Task Scheduler	Run new task: dllhost path: "C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe"
22:52:06	Task Scheduler	Run new task: dllhostd path: "C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe"
22:52:06	Task Scheduler	Run new task: explorer path: "C:\Users\Default\explorer.exe"
22:52:06	Task Scheduler	Run new task: explorere path: "C:\Users\Default\explorer.exe"
22:52:06	Task Scheduler	Run new task: RuntimeBroker path: "C:\Windows\en-GB\RuntimeBroker.exe"
22:52:06	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Windows\en-GB\RuntimeBroker.exe"
22:52:06	Task Scheduler	Run new task: services path: "C:\Recovery\services.exe"
22:52:06	Task Scheduler	Run new task: servicess path: "C:\Recovery\services.exe"
22:52:06	Task Scheduler	Run new task: sihost path: "C:\Windows\LiveKernelReports\sihost.exe"
22:52:06	Task Scheduler	Run new task: sihosts path: "C:\Windows\LiveKernelReports\sihost.exe"
22:52:06	Task Scheduler	Run new task: smss path: "C:\Windows\SystemTemp\smss.exe"
22:52:06	Task Scheduler	Run new task: smsss path: "C:\Windows\SystemTemp\smss.exe"
22:52:06	Task Scheduler	Run new task: WmiPrvSE path: "C:\Program Files (x86)\windows portable devices\WmiPrvSE.exe"
22:52:06	Task Scheduler	Run new task: WmiPrvSEW path: "C:\Program Files (x86)\windows portable devices\WmiPrvSE.exe"

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (449), with no line terminators
Category:	dropped
Size (bytes):	449
Entropy (8bit):	5.88205351207227
Encrypted:	false
SSDEEP:	12:sF9yAbWj2IwemWuTVtu8jo9uvJnpY3GQT6vaowNN0:mK1epnuYowhaXsH4m
MD5:	D1118F9CC1523DA68269E963A085C9CB
SHA1:	F5E1213048531785B6F4C46BA58C276FB23D9DCD
SHA-256:	3DD90BAD430AF41844636625EDA144608AB22DCAA09F2518000FABBF2BC758BF
SHA-512:	AE52C721ACAB6DA0ED9F7A8E2E769F6BA2260A4314B14FB5086BA816A5FB179292998C0357F9D1A269A54B9BB2E8AAB3CFB36FD56AD7157C467545B48EB2FDEB
Malicious:	false
Preview:	5QmOCAPQNBjFmllisfC3RAjfKndXyFxWBIn3IZ82qwk3zSHFDgzzC3J4rHEZg2cHNMDd7raShKNeapp2gXTRQ8TH8tMBViVyUcqnOnIWGgS2qpeBbM3IiL1P25fOeY78zYK78Cn2P7KtpbbSOLkJpMPJlauSH31sjUDRegCYiA3kAIjbeM9TyxSmJBWiSVuWGcJVXKxsILkoTpJd0Ty54i4wBaIdKeGNQgeh8ODUYRKmMoTe23r9gzciiXT6BUhnFXYwKlemPegmXRjXHnlRxHqaE68l5GSEtghzQhTQYEtCTzKRy6zXsQ07r8rOn3qILb20uuGkUV2sXnGPvrx8R4WdqjHSzEnfYk126UgEzPDWYHjD1cd5Gr1RFZKLmyuQsWUxwOSbLsJB19Ei9EaWlrZqsjwgJUbAexoBxwQmJCuXi0aFUlMhXYoB6oEMbwR0Q

C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\Windows Portable Devices\24dbde2999530e

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.756651084849567
Encrypted:	false
SSDEEP:	3:FMFLJ6PV+rcvUSrK7TvbsUECY9ZVsAIyv9zqPYmDk9NI172l55hsmytD8VyNXdWU:F1EAvRcpEF9ZGCdqHwy09RVyN9UfCpn
MD5:	AF9FCFC3E8A9393E84F3A3C42468144F
SHA1:	F836C31576E2999738C81D840C98546DE971AC72
SHA-256:	6B1BBB5E02D40FDBA3B0403ED4A09AF0C5A6E0BDCFD66334B5294DDC9C1BCE63
SHA-512:	0BEDA155A47A8F5C5AFE103713EE6AF92BEACDB105BA5C750C7DB85C4503FD49944403BB36EE9E59DADFCDBEEF7882E709EC53D794DE5F636D068B1C602942CB
Malicious:	false
Preview:	j4gYbq0xbnTcIk9MK0NB9q8WHhbXTT6blqtEo3ismdO2ZZI8FKNoqdP36JR4PceIq21c04iQSeZgcF7rZcSJFRuHa0IemncJ8GMhipIKm6WLEsb1MjfxKUCYHtB9wDooBPhV3ZJtTHhJ5iDrZQSDIp9nDxayoIXiSrKyLF7wZvdCx3cipTkfukgWQ3SG9UFLt80OYOgUTfnWM60KU1IUh2xsKxiRx1xEqRSzDOJbwQMP6JJTDIvIMun1KI

C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Google\Chrome\Application\117.0.5938.132\27d1bcfc3c54e0

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (955), with no line terminators
Category:	dropped
Size (bytes):	955
Entropy (8bit):	5.9042525447750895
Encrypted:	false
SSDEEP:	24:4wEIDKor+vzmwLv+3OEfYngvsDfe2eFzYt03gI:4oKM+aqHsGwFN
MD5:	063AECE9EAE40907D277ECDF61343273
SHA1:	1885DB2E2C89137455E5626C42C981A89D728D36
SHA-256:	45D9625FDB9876F630557CF2A6CB979D9DECE55FED14D17DF91B6B672E8BA7C6
SHA-512:	72974415ECA67CAE7AF5EF5647D30688B842E36C6C50BD4DE8CAE160B9B0CC8CEB38FEDBF10226BD4B5CA52E8BACC35E4A6EA914D61190E0C48E4F2F1D4E854C
Malicious:	false
Preview:	SLafpL0AaqYYkj1c2gnZEgrxGKLWAYFjljOjkzJdI95bfXaZOYRZF02vemZe9eAClzxBVR2CWKREkPSsuvIlGpduqcF7apdo930pkZE6fOD5jyLOUquOVY55VCU2M5mrrmFrZmIVqLG2miL2R1mu5PSk74UhEMujmWO6tdzsiYhJSCTx0ckUS1vbUeueSkQebgQPUPIyC4MgrJS4lhqmlZRukwlOtUa7HDsvwDclTwSYpPuLMz2v4o2BPfphn4FreOZoagIiEFSyG2EVCaB4coDcKqfRX47Yrl3b0FuqqTqyWE4WaUfN2LPzL6duA0KJH3Hf8nf6pVNI7OGGvI0DZufgVEP3l9p0Jhrc6ZYxyjhh7H17zX92AHuXXkJ4XlUqqX8agoJWuDOzM8iOMSEOAxzCxUEWPdZNO10kIbaKOnH724KZC5rFgGp3h6mMkxGRoBkVH7Gv23AXp2J3JpUTvTqIL7DLyNkagzT1TzREz6MnFSNpxtD4dxfUUcJK446oSj0zjSkUXPezHDC2tYYFKp7tU9g1pHJ49hUgcXFeIshNSqMRZRagg1emlHfkwtpQGk0jsgaVS36bItaowObXqmXHDr4U2fsZDQHszni20EOn5De1q1xhRRjdMsgAlFdwKgX1msyJpiglYuMANCnArKIwrngHGiRulccYpmP8Do1su8EbfgwjccE9YlK9LqCHRwA6SyUlxo7CTaCsiElkvrSIXc9EbQxWmua87IJrLLvxfBq8ibaGEcWkd1izyQJh1kaj9Eva54Yj5fnVwBfAzqRKX0eFjU34CO54lH8eqALKDwo8OMDwvJrLSQLJjp0kBdhrjsuoDATzeGGlMg0XQGJ3humV6y5AKlJjP7YgcYtuz1qLJj7CydT4UnJyGZsOFSp37gWOHU42XYEqEaLW12LrRPPlxkaCqepgLxOmNs4eibh5jdupNWWMH8m

C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Google\Chrome\Application\8b5d9cd934bf30

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (701), with no line terminators
Category:	dropped
Size (bytes):	701
Entropy (8bit):	5.8671855672876445
Encrypted:	false
SSDEEP:	12:silVEna9UZrVxRvSOKDXcSDwV3KZMpmSt9Ekl15BgvtT8wttWro7NMZOJzqBo5p/:9Vo2UZxxVSFDXBOxNNevuhro7sezyo5t
MD5:	7410E37A8C07BA6845535576BD1A8D8A
SHA1:	ADE333C79F0BC3D93D57EB63D1DE7F117F55C3BF
SHA-256:	6469FB44B590714D9B57FAEB336AD4DBCCC3CE2345E5F9C5FF91A11EA46FDF5A
SHA-512:	EECFE98E35617682B880A4B87C1560EF0D40839C1C1D6D66318A48FC4F6B9E8B15419030F8E72630A489F2B727E0446B3AEC646A3D68917E79848E1E9FBFE389
Malicious:	false
Preview:	IzrTBT0uzTHdZNKgUdQXkqPpNC9ceoNNNZzxA7sHqJC2uPIRGoOp2lGcjCG9UXPLG4P9XXgXuJqanX473sWzZiVmSXN70sxT41v09I3sH14t5qzLIIGmBaviinq9JjgCWWgvmE7uynrinmrmiCzrmKRdFNRWc3iiU2WiKDjDLVxXsN465EbHuyZLECqYxlS4EJNvPIcfcvgQW4v2TUaYcbxgcLdHXLQjD3TjAJrwl6p9RIyKRxFcK3cnVqSDpUHRe7NdkL1JnowgwyOUXS0jGyZJbpOT0nHQyXeU5UjF55ygH51gb8qWeiLphEC47iTAggrYU4YCsunKA3Cfyr127vvPMyw0SpHXmy9lOcMhjnnu4ApoCgGQraDuubMfHitDnQiM3bRVeTTTHBULIIywj1pLuP0wQqZB4jGobdulPuvXHtmsHAW9t7evkXbokeEx4RYi4qtpYNgyFSDAmIpQUaR6FUDECGAup7czVExaQrkgbqqSTaCczyddAcdkmpmSMvIHzOphUO9mzufYovvmDi51e9z3lNylESUphicEueHly0oP6E503AOn0Rn0Zw5HaYiha01FTq1jbTDnUj6hR7rDEqyQ4lp7jALaRHzGMzhNJpLgNAfz0YzcqfctBlLrA49bInVNuzVcae4ZeRC4G0HLKstwoFFlozMPpuYkoRFADXCLkDOtjRlKwyQa3

C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Internet Explorer\SIGNUP\5940a34987c991

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.701976304011683
Encrypted:	false
SSDEEP:	6:Smifqje+OIYtckyR/DAABd9wbE4cutn3TIaucRmp+Q/+d:V2qje+CDC1vEzRlFd
MD5:	337A009087FCF786767DBD2414FB4C9B
SHA1:	EFF437C14DA88B10D31594419FEAC4C983B87315
SHA-256:	1DA88856D99BF7706338AF5208960C3DF1462D7D07AF0A3FD467A16FFF30FD62
SHA-512:	82E261FDC48DF74F434A1774D88479AD638F4D8D8EB0EB8B551092E843610649B42E5BB0779D864850F33FAF4CC2DA85EE5C3E6A1E568F71123A7FC4FCD08B8B
Malicious:	false
Preview:	i6CH2JrLhI4mGInFJrEKXu4GaTWuR09ujLGE4gMDuktrWfa5r7lftnzyC6rix64rJJD5CjLmfBaxBMt43bDTPeB6WSB7zoPyqCiNce3Hw8AsNBwzNwoW3kboHGiuhNx0vmH8ofbYh5hQeTsUfLuC934Fk3FV6JkjKJ6l4xLrVQy7CKKyYOOWcv11rBXuaGcYV8FVWHar9DrsF7CZsQ7r4N

C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\SoftwareDistribution\8b5d9cd934bf30

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (717), with no line terminators
Category:	dropped
Size (bytes):	717
Entropy (8bit):	5.880759486325108
Encrypted:	false
SSDEEP:	12:YJI+uCG9viTx2Rdpy9ZNcb18a25Ovu0s4aOfd8VtzmwO2lzXfb5w+UQD:B+uCUqTI0Zyh8XO3aOfVR2N5w+Z
MD5:	8582DA8486C2F20998C9E24619E29BDF
SHA1:	6728EB91AE61BAD46BB511E887FE2603FCF23A37
SHA-256:	E23E77FE98B22637183168B2C145EC107465F1DA6DA54089E8263409E3BCF17B
SHA-512:	3B3A74B90F634EAB4E20E147B3FF45AA279719E733A9CD8B910D6EC0CF30B248EA63ADAC62D60B6377B6BF4D352BA67A60D5620EEC39D052C1FC42DB5584674F
Malicious:	false
Preview:	tkBt2nNfTQ0dNc0Y1nwlbGEysS4D1abbnpc6KBwo4HOTFtTvpX1d0EQnfNAksKn3zZ0hA3Oz1IrT1vt98JYej7kiYza7AL6ueVdp2vvvIBmsX7vueBliwIT2zSJLdRzpM7zgSDGMXmViU2LbDpd8kX8VCl0kmkR1L6fZIPca5YLJxuh7GrHxy0Fz9deqNfkxUdWYWvTyNCDLMyiRE3d5cdDV1qaovvMZyXyTYJkVXTkvx4nK4NmUCpU0aBgqUoCcznWy9P24SHhJ3Sh7CQtiI2XJC83Wm4BsQI5KhyKpUrC4HL7HdjnE5eT7PNvBVfSYGz3vWXaNFEOa0dC1Bv3DQ6xvy84TDJTyZnxSSLvFJZ90Q2GvL4AkmOHKBH6XcGK5uZAMqtjz9x3076f62IIIIsLLgnQKOXmDPDG013FbUKlyUQMEmAfU7BwBOzpDcYkmL0l30oE8Dry7HX0QaMiO1SFNQEmBNC86k8ndoTO76hQQNy319ZmQzWu2vYmvBCuAs1XItWmH8kSUBz9cLvCyasGNOvsPqc63wQhVbuHnxfSOEZ06ZKkQA6kAvJ48nWafoYhvRnAanYA4Z1Jz4w0f1p20phkR0J9bEwjp1FovJKml5pk3AED0f5o9frFtDtjdYj0nSd7zHFVrCR5A7rQwGI5JIkJK95ralJMVz6lgGNtaj76OvFvWcxXPoqfrTxzMX5F3EkKAGup2Z

C:\ProgramData\SoftwareDistribution\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\SoftwareDistribution\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\regid.1991-06.com.microsoft\cc11b995f2a76d

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (354), with no line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.8200806888768595
Encrypted:	false
SSDEEP:	6:wzRQxmQNd+GOVPYOz8q3eevcExuh7TUzSuwrlNYcqVsuRuTkIMgCPML1O3G7ch4H:ARXQ4VAWeehwzYcq6HkcCo1O27chsrpj
MD5:	8A4DCF60869939167DDD3248D71E695D
SHA1:	C606DAE19202F02CEACD9631AF85E436C020E4F8
SHA-256:	6FC771C8517791AF204CBE18D5DEC056689C02B9181927AC43C3DDAFAC3E2534
SHA-512:	50197D4894F2EDEAFF4CA89E1DC337A68B685FF83723A64A5403BCA7D21455A39F995C537EB63E9BC1A6CAE046CA6BE7C1D236E34590BF2D837393C5F48AC287
Malicious:	false
Preview:	CXOCc0e7rGsaPTjb45Te0HCxZqqcuVX7yZraWPN3Q5uJFU0yOOnQRWf4VamvKBNVtum0lIFosaO4X3rFz1OgsGqb3xF5mbtPrYZVsANFI8h1Ikgcth6SwrnmEK6yCJBQq9M9dWXzoIXtjyTSQnMFfacAvxQhDZC87QKJYh8WKHonT3CP0nhZ76vPgMNpFzvOGYwSnK4toz4Xwzq1vAqZ1nAAe4mLUTQVVZh5HumqtyuIBYdrfV4FIWXcXwythtZVijCXRvuBYAqD328Gb5p8ZLM9BEhU53IAZZkcVFZuk3qHqTjfxrRmDa5WWDVNNZFf2qodRguWf5XgeFSsfBhOlf68dNFStMgKyL

C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\8b5d9cd934bf30

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (642), with no line terminators
Category:	dropped
Size (bytes):	642
Entropy (8bit):	5.8691404269310175
Encrypted:	false
SSDEEP:	12:4DRd5c98Z133j+X/1VmjCVh8PSI+sUOSj4DNwtQiS+zAU+wjogU:Sc923TSVgQ86I+X4ULSyAUxUj
MD5:	05788D0CBC7542EDC08E0B78EE0825A6
SHA1:	20A868870703B83F587739D1CD1B470DD2C658AC
SHA-256:	E021E9CAD79A6838831C404B3FE12C4ADCA4AD268D0381311047A159846D35FD
SHA-512:	998CDD365F3B6FFAD8A36D305EBAF5DF8C29708D8ED377D47B20B79885720696E88EEEFA9E664685C91610B5A537774856D90A1BADF2DDB1C508C0B1A23F2C03
Malicious:	false
Preview:	AGGrrhRpivBoOOoGp26obp4KjuituhXdOqCBoaeMWLlWC6cA2VDqtQMVM6I79h5BXhZiLnbOYtSQDhImSh1Yeru8erzsShNyPk9eg4yO4yRA85SoyfpbqhgqxbDeys51fdAcinGXtmepZtAiYK4x2vIsESrF0TaL3aee50FLZRsDC1QDafGnyH8uURXP5AhZMSw8PfmiFtYkDEpNBnoUNwWvbuKnczPYtT1tESy52hiFtXrQmKORVMLZ6AgeV8FPdA1tN5ItztbqORCDD3BRl7ChHcxEvTj4bSltg7DqCeclvfKo8cbb7yog7UmuIE7fJhO6pShF0VPGebwmRIFT2I6nnEwMVSi8g7cNRO8q5VlljhBgh9d98onBkkSlgUuhxQkh8iUDJZXghVEGDQoVzi91Tamq5XJlkDyS7eh9pazjRHePgMhQpZsORsOh5oHvPw5dgwIjspqYtakM6XKt035LUkAPQ9DBTDTeLAstD8hAtTf1HBlidX5W1uJ6v3TtloFpGGA6oap1V5bAEJIOYfh5H7nb1w8KpyYENzuBAo3CsEB5SI1luEUGHKhJcjF2ceMggXwPYGOtleMD6rIs4WZkdR7DSliajBkN2eY5VmNo0kfm7eMuaW7FElCPZt7wix

C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\c5b4cb5e9653cc

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (906), with no line terminators
Category:	dropped
Size (bytes):	906
Entropy (8bit):	5.885589547498972
Encrypted:	false
SSDEEP:	24:2JunRUdP09mGCWOhsFt7p/GkcXhwVQ/TQ4h+iCf5a+X:2JunRUl0sGCj4pMXhwVbli0UI
MD5:	476242F71FB16BA315108DAA72F98375
SHA1:	47382B9662AA276F8AC11860ACE58E7ECE6A4F15
SHA-256:	77C84C0B0105A1A81805A6D74B64DFB74D7F10F7112A96FCB91080E7EFE7B122
SHA-512:	8114B8F6F6108DAA7574F72959E903FBB4B480867B42DB38CB971E9ED0A0CC9B8872BA8C1414BCC2F52D85FDDF01BAED1CE9C9542396BABA239F6C2C8A856CB3
Malicious:	false
Preview:	t4rn3gyD4vC7BBSoawXkFFYyVHeM6qYD4WQLcMmv9p65feZj9tKx0Xyog2SvCmHNX9DpvHLOJllaJcT0r5MNfkNgimpj40tXisifbuy2h6nOvXfEjbDGZ4rwvgGIcmUT2O2a3xZ7HUpj79uKHkAcwm7oBwu4npZ5mTVhfEKvBF9EOIyww6B1m1gPROZHDeUc4u7nnNpCaOaqn2Z377IrniTuwGQRpCshvgKeLLJiR9aXa0lYygKFWnyWbM0h6XWYg35Gs5rwyjZnI5T6e1cJ2mKIsxD8Umm3nB1h5fq3yXRxNLOf23CF5Mf3txY42tcM7gAGEwB9LjVeVW4hjhFajh8ag7xHGvAE5F0qKIbF2D3V1BiW21UUnBmaikkG832ZiQjPgNWbF9ignmjeZbPPbpb3caIkiVH8KdwkbSzoe3PndGw5AFrhon82zpxGFw3u2jVJ08DGlkuiaxaVnNjdojTgf3uwftjs9eu3vnEBBk5E3ZcBObc1MaFTPyn6ORk2ABi5ChkAIhbDnPnFbshDQrgjZbn69IxuADD21g8r1ctp9CpALhfftgmSf9gl3oBAtqDkLuO5tzMx81jWvnubnSBdavX19XxMat5S8FyaTkv3UyUnZK0Q4kXbpkJaXX5WCAWP5QXqyTHDhHIlbtczhgS0WdnY5XD6oY1UbErIwJckcT4hbh9o4Fzfrg2bn9uaPLYIPyJWBTDXErYCjG7XYZBjjWm5MPfxZBUQ5vSmXmmlCba9H02gBXB0Kzi3MNKvyQ8CXIGxxU9vxZgH5myWX8vB9eFGNZaKc0xwdYm9tEtqXPDuSb7jZyXze6C2CAkY4zT6muohAzmTPEouaVxvb0uoc7RgVt6sdUwh6HHhxZikLEkZRSbrMy7DFodpdHMQ24z5SHxTNQ

C:\Recovery\services.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\services.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\Default\7a0fd90576e088

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (356), with no line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.8366069976320425
Encrypted:	false
SSDEEP:	6:Om2GYKb+q8Jr5Z03TqZ0v8Cxzt6kkTueJqydyXqEFGdrVKWtFTtJCT/U8AzGwHyh:8KSq8/Z0rvnxz7RWq5Xn+jFLCLU/GwHk
MD5:	658832DF35374A02557FEB34CA4DC8C6
SHA1:	3367D94116EFEAFFD35A996243D48B34B805BFD9
SHA-256:	6D5DB7880004055BFD654037BBF4448209BEA7DA0C7F82F773A979196A2846E9
SHA-512:	42EF86CE5D81ECAF47CF7718F19B1E0BC514E44AD972C20EBFBE5828A55CD6898D14CE21F1383F332F2C9646C93B282A3047769E157E28D4B297BC5F27A1BEEE
Malicious:	false
Preview:	riMNg1a0oVTGkr1xYZBSebweZnkPjXMN4MQdjLnnokBBAuXGoYlNFA1Qvsy3QKRQJFLXbXONwXn4ZvdpQelLv9I4V9s0XuXeSv25i9oQJYbrW619OImviFeJ7QCboX0BAJln3iGQzUBXibiYItlOHl5NRs8R7MlwhZqNVNFqCW5OEGlfsnT5vm4YNYWLkyTmsP0IuVD5n5LuprIKGcjU3qA4fR9604FNDTfyQdvXjYR0aJtfPMFIP8tCP5ndVHEtz8rWMU3nrMueYKeVidqoz78EjcjVzRBcUiAcbWT5TbaDOOoEaR51aa41AnwtuhxZKSK0JB3LKvUXg40Vye4iWKC3nIcyjjKvoB26

C:\Users\Default\explorer.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\explorer.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe.log

Download File

Process:	C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\umPJEpnOgL.exe.log

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	5.36827240602657
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpaqZ4x
MD5:	B28E0CCD25623D173B2EB29F3A99B9DD
SHA1:	070E4C4A7F903505259E41AFDF7873C31F90D591
SHA-256:	3A108902F93EF9E952D9E748207778718A2CBAEB0AB39C41BD37E9BB0B85BF3A
SHA-512:	17F5FBF18EE0058F928A4D7C53AA4B1191BA3110EDF8E853F145D720381FCEA650A3C997E3D56597150149771E14C529F1BDFDC4A2BBD3719336259C4DD8B342
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Download File

Process:	C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Windows\Containers\8b5d9cd934bf30

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	5.187396439045672
Encrypted:	false
SSDEEP:	3:HOyQjB/ccOM66VfH:HOZjBxOifH
MD5:	962A4BBA8B6314B5127B52A48099F36C
SHA1:	06EED00377BC73504832ADC3B0C84409325218FC
SHA-256:	3F6A8162488908598021DA37FD404C2DE33C9D1F1D28E00E4FFD638E3D20F5D1
SHA-512:	D5CE08940684DFE684631F7A07C2EC41A2B62BA0403E238AB404D39B5F908CFAB9074B010A3E80A234D4C471B5FC8938CA96D5EF9A5311FE03E3293978E3D86E
Malicious:	false
Preview:	Z1RunrM204Wtp9DbbmTYMsTzSCZyQRqYz5EWxiFeUS7R2QAGJzfSxt0qhcb

C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\LiveKernelReports\66fc9ff0ee96c2

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.783865882060942
Encrypted:	false
SSDEEP:	6:ziY8vdl8NSnBm4eKPEqjqKi12ukkxe5es9iZditFfVi8:WHFlhnQ4ev9rbkkWeWiZditFj
MD5:	C490CA5D20CA3BF7DFAC0109FFD07433
SHA1:	D890DC0377C4D212FE254AA6E8F6C3343676D507
SHA-256:	B769304B1D35ADBB9C1F4C4B51D473B43C124BC729C805AAEAD156F1A753BDE9
SHA-512:	CBC2ABB46B602447D3FDCA9CF97DC0C6FBE048F2AA733942E87AEBA8ACD98DC64AA27EF7440F607C580A0556A1C5B5163D31FD293A717F89EA89EEE178C823BB
Malicious:	false
Preview:	OxZmEFzcQxhWZEJwu88BJIueH1qDRNhRiwc5pU8U3yq3X1qVISJ3bZHGC5eMZvKCPPxnmNGZAnIUb0HQLV58EozJoW2u0v5HoooHDDs4Lt3yQxoMyNBD0M8lZo8QVWjPrBqxM9NHmBwUvB21rp6mt1QcpCsYFcizKoGPG09zA4bzZo0YvHipa7fzuOIKQyBKc7JG4nu1qHlzabCBLTm832YNJQe2rziL2RWbetdIWq9TVpZSLH86LDQki67nI1J1ia7JFkhb0elN2F1d1Lqk0l9yA

C:\Windows\LiveKernelReports\sihost.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\LiveKernelReports\sihost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SystemTemp\69ddcba757bf72

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (422), with no line terminators
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.839494655259772
Encrypted:	false
SSDEEP:	12:IhUEzrJdDsFbAXWHCEsU2AHRTGITHbMtCVuslXT2:nEzVGFbC6r26kI/AxslD2
MD5:	503847EA211F9BF4C0D816FF0AEAD367
SHA1:	025A20C2279EF21837D0D0E05DB377E8DF4A6A13
SHA-256:	0FF8D8DC4A213B6904B912AC8B6C5E39988722982D9F3DCCA982785F607F6B05
SHA-512:	134FE4E99BAEDA1C6EE441C2B070AE671CA31034CCB4782DCCB6C55BF33BFA6EF7782042753C2530FC57604B77D855B7293890F6096949A1A49EB05DBB333372
Malicious:	false
Preview:	5xeUdlf2HPQkERtebf7s9KbL11pPosxIn3KIWSISQSBUrGtc9f0dMJavVTcl6QOZbI6KHlIJWpcqIGevHMPI1U5edZwCzgV9El2iJiUYXqGgqtmPyqetBFiHMbrryFU0TdlgN6li20vKNZytwgOICm78DvVs1mjRWQNNHGB2F51KUX4xn75R1Lyqfndck3qPQdx7MklqfVDGvwoq1iE4rSaLbgreniSLOm40j6lCVPwgIr5s8wlBzwh8Dmfp3HD6C11J2xG47Bicf3Cuk9f07RWcE5w7a5JOLzdQ0wzKqqExNFcJjvF3lN9vfZE6BJdC1TQpaw3yJUJQNiO8cmXp0Pn80svar3JhNB54zxtx1QuQDti6KGdYvyMlqRzrBdHQLmCLmUIp2jxjfX5HJyPkZvvYzTNi7BwYJeEaqW

C:\Windows\SystemTemp\smss.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SystemTemp\smss.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\8b5d9cd934bf30

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (353), with no line terminators
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.816194023618803
Encrypted:	false
SSDEEP:	6:82nlSPzbtfjPmB3tD+J7xSLfYcaEuYNZmGIgjCl/BhtETVKEaqqv2El4:RnC1ms7xSLfYJ4agjWTtIVKEyv2B
MD5:	4DA4D4663C1E7603307993136AF1EDD5
SHA1:	F36074E593B68F05DBB8731F95DC2858C593D3B5
SHA-256:	AFFA9EE00FC51BD2478E3295396E89561BB67DBF59B5DE4B7C03C741D24297B9
SHA-512:	735B1D01E972586E367AD81990A33E6371121A065526929619A75437E3744292A143CDFBBE6E6627BA6DC787AE438372287DB32E0D213E4FD6C2D84CD9368EAE
Malicious:	false
Preview:	7xw6qJb3NTXgCn1CKL5vPsIe0JGUDYZ5DC7RHH3AjMhVe3c7TluM9YFPpRGgDH0y4cdApj4DR4LDLw97rIAbnM5p6smzAW7cWsbCZcRuqr5FMCD3SJz4GZKrgyD67FC46trcU7hO1Qu6R0c4ptg0hDV6iuflZVxloAIcUkiVmlD0oOaqVIROiMX2Yu4kb5zgcJRRr9jEKLO6AeSTTyQQDjCcmQEkp74qvgXf6I8ViMDX8b23clQmpic3Gyob59ZMRhKdGwWL04s1fpeLXKIErRBNEeZHegaiw0GaQYxpOFwu0kYaUdDu1Vf9f7ZmXOqTdJEoiD49XczleQXeF8xAcqrbVG5T9KS9Y

C:\Windows\Tasks\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\en-GB\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with very long lines (594), with no line terminators
Category:	dropped
Size (bytes):	594
Entropy (8bit):	5.872152399053197
Encrypted:	false
SSDEEP:	12:pqt5cAHo3EdkUkDkn9bVkdnk4xRAYqQ31glgJPvdlKTKH7fn:pI+AHo0s0JVkdkY/hFglgJtlKGH7fn
MD5:	AE8F6D6D4251021EB1C0B285BECB8A32
SHA1:	931B6D29ACE96BC99E5ECEFD4B9AC4D90EF03609
SHA-256:	D35D4C478C38B75DB46AFEB34D7F788B7E6924647C968665DA112429831EE34C
SHA-512:	8B092780CB8E7BC4AC96FB0D1755D11DC1E2ED1DEF1FEB0032BF87381F88F1E6B1AA9A451F18F0C96B9607543568126F66DBCD8746B6A2E6E3DF75A1D5D3DE27
Malicious:	false
Preview:	jhGrbDrdFev6KjB7aIITs9p9eGquU6vl8GATeSW7EZbSEDT7GxejH42k1GMUW6JJsK8EisdIwLOShX5bxsnhbMeDNabXFBkHQSj4EPZYUVx5qjCdLuhoTlrgp50HQFDukHCPxBXhTONGZiXoY7LUd6yolDPJYRIOSCVjgxpKXAVEYkGGhMtS3sQoSYnuvOICG8yWNyHlSB7dluQB6IlMh0UjwqQIJ5YJ1S8Zwu2tEIA2vwDiImxnm6eQnOjgh9bWnxmSv0OMQ1HYzcyAnrAhHvg5xsvhLWLFrnP7KuwRXlXuyGaKaj3z83O1QreDErA4qBrMN0z25sKgYvGrRkGlcVHxYXqcQsMqkcEwYO7ktA4QtsdekxwekZbU43x0JXmMfd55rTSDng2ca1Ep4M1d6sFLBu1faGbWXsuPxhxRes0Eg83DyH67fJPxYt37cwmgEfEsHz2WYk8O1BpC0xqTKe1Od61Dn0yrFT9A4L69Oji4KB5WE0GoGTWko0PK7zshvQIiBoIp1rEk57DbBe9xuKlv7ZWE5wBZ1AI32XVasaxYPvorwxJdz5xlpWkmSEuEpot5zJjoJjETXMgMuo

C:\Windows\en-GB\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.0766822916335785
Encrypted:	false
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
MD5:	57A49A947BF36386839F2691A692B329
SHA1:	96AACDE39613ABC5EDBED8EA428A1BF43883C57E
SHA-256:	783669C0F379D23BEAB6567975BCF3748ED8E0A91F467C52E12BA597E568940E
SHA-512:	29F66D4403009D433807EFB4D25C84B4E807B1DD8BAE6C7D2BF9ECCF09421D7831F4CA01FFCEC90418D3918148F9D92DDE3A2525B8A0077D3778716EAFF40AB8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\en-GB\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\umPJEpnOgL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.0766822916335785
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	umPJEpnOgL.exe
File size:	847'872 bytes
MD5:	57a49a947bf36386839f2691a692b329
SHA1:	96aacde39613abc5edbed8ea428a1bf43883c57e
SHA256:	783669c0f379d23beab6567975bcf3748ed8e0a91f467c52e12ba597e568940e
SHA512:	29f66d4403009d433807efb4d25c84b4e807b1dd8bae6c7d2bf9eccf09421d7831f4ca01ffcec90418d3918148f9d92dde3a2525b8a0077d3778716eaff40ab8
SSDEEP:	12288:G5uzdtLxSu0iFlTAYQw0qJCh2L0iU3NEMJrD5g7CxLLSdYsVljSvZvkTj/q2:GUdVxSu0iFCFqJChg8bB3SdhusTq2
TLSH:	7305F5027E44CE12F0091673C2EF454887B0D9516BA6E32B7DBA776E55123A7BC0DACB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rb.....................6........... ........@.. .......................`............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4cd4fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6272A3D7 [Wed May 4 16:03:35 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcd4b0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd2000	0x218	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcb504	0xcb600	543a3110cca64acf2562d052cefe3014	False	0.5058497714351567	data	6.116592484669803	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0xce000	0x2fdf	0x3000	1a19ad131f52880030f02f1dc4d430d6	False	0.310302734375	data	3.2422115774464424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd2000	0x218	0x400	a0eb98cfbb72fea7cf0984384d7b3371	False	0.263671875	data	1.8371269699553323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd4000	0xc	0x200	b2e6f55f04571ab723674ac832c65204	False	0.041015625	data	0.07763316234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xd2058	0x1c0	ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970	English	United States	0.5223214285714286

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 26, 2024 23:52:20.110395908 CEST	53	56206	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	17:52:01
Start date:	26/06/2024
Path:	C:\Users\user\Desktop\umPJEpnOgL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\umPJEpnOgL.exe"
Imagebase:	0x2d0000
File size:	847'872 bytes
MD5 hash:	57A49A947BF36386839F2691A692B329
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1777428806.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1777428806.00000000029D3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:52:02
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 6752, Parent PID: 5860

General

Target ID:	2
Start time:	17:52:02
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 6808, Parent PID: 5860

General

Target ID:	3
Start time:	17:52:02
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 6848, Parent PID: 5860

General

Target ID:	4
Start time:	17:52:02
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 6900, Parent PID: 5860

General

Target ID:	5
Start time:	17:52:02
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 2504, Parent PID: 5860

General

Target ID:	6
Start time:	17:52:02
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 7004, Parent PID: 5860

General

Target ID:	7
Start time:	17:52:02
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 7068, Parent PID: 5860

General

Target ID:	8
Start time:	17:52:02
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 7092, Parent PID: 5860

General

Target ID:	9
Start time:	17:52:02
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 7096, Parent PID: 5860

General

Target ID:	10
Start time:	17:52:03
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 11 /tr "'C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 824, Parent PID: 5860

General

Target ID:	11
Start time:	17:52:03
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 5812, Parent PID: 5860

General

Target ID:	12
Start time:	17:52:03
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 7 /tr "'C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exePID: 6224, Parent PID: 1044

General

Target ID:	13
Start time:	17:52:03
Start date:	26/06/2024
Path:	C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe
Imagebase:	0xc30000
File size:	847'872 bytes
MD5 hash:	57A49A947BF36386839F2691A692B329
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000D.00000002.1845475045.0000000002F88000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000D.00000002.1845475045.0000000002F55000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	14
Start time:	17:52:03
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\services.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 1104, Parent PID: 5860

General

Target ID:	15
Start time:	17:52:03
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\services.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exePID: 2496, Parent PID: 1044

General

Target ID:	16
Start time:	17:52:03
Start date:	26/06/2024
Path:	C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Containers\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe
Imagebase:	0x4a0000
File size:	847'872 bytes
MD5 hash:	57A49A947BF36386839F2691A692B329
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000010.00000002.1843698850.0000000002838000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000010.00000002.1843698850.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Target ID:	17
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\services.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: System.exePID: 6204, Parent PID: 1044

General

Target ID:	18
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe"
Imagebase:	0x3c0000
File size:	847'872 bytes
MD5 hash:	57A49A947BF36386839F2691A692B329
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000012.00000002.1848659851.00000000026B8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000012.00000002.1848659851.0000000002671000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Has exited:	true

Target ID:	19
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe"
Imagebase:	0x220000
File size:	847'872 bytes
MD5 hash:	57A49A947BF36386839F2691A692B329
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000013.00000002.1845832491.0000000002657000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000013.00000002.1845832491.0000000002625000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Target ID:	20
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 11 /tr "'C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: winlogon.exePID: 6780, Parent PID: 1044

General

Target ID:	21
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
Imagebase:	0x540000
File size:	847'872 bytes
MD5 hash:	57A49A947BF36386839F2691A692B329
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000015.00000002.1847435406.0000000002951000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000015.00000002.1847435406.0000000002998000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Has exited:	true

Analysis Process: schtasks.exePID: 6828, Parent PID: 5860

General

Target ID:	22
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 6868, Parent PID: 5860

General

Target ID:	23
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 13 /tr "'C:\Recovery\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: winlogon.exePID: 6852, Parent PID: 1044

General

Target ID:	24
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\ProgramData\regid.1991-06.com.microsoft\winlogon.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
Imagebase:	0x540000
File size:	847'872 bytes
MD5 hash:	57A49A947BF36386839F2691A692B329
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.1849515045.0000000002988000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.1849515045.0000000002941000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Analysis Process: schtasks.exePID: 6900, Parent PID: 5860

General

Target ID:	25
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemTemp\smss.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 2504, Parent PID: 5860

General

Target ID:	26
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\SystemTemp\smss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 7004, Parent PID: 5860

General

Target ID:	27
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\SystemTemp\smss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 7068, Parent PID: 5860

General

Target ID:	28
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Default\explorer.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 7092, Parent PID: 5860

General

Target ID:	29
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 7100, Parent PID: 5860

General

Target ID:	30
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 1668, Parent PID: 5860

General

Target ID:	31
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\windows nt\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /f
Imagebase:	0x7ff7699e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 3864, Parent PID: 5860

General

Target ID:	32
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUp" /sc ONLOGON /tr "'C:\Program Files (x86)\windows nt\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 2492, Parent PID: 5860

General

Target ID:	33
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "DLNpvJWaIHlCSYcBbohUXVmmYadyUpD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windows nt\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 6828, Parent PID: 5860

General

Target ID:	34
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 6944, Parent PID: 5860

General

Target ID:	35
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 6984, Parent PID: 5860

General

Target ID:	36
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 7052, Parent PID: 5860

General

Target ID:	37
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\sihost.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 7088, Parent PID: 5860

General

Target ID:	38
Start time:	17:52:04
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\sihost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 3848, Parent PID: 5860

General

Target ID:	39
Start time:	17:52:05
Start date:	26/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\LiveKernelReports\sihost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report umPJEpnOgL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Windows NT\8b5d9cd934bf30

C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe

C:\Program Files (x86)\Windows NT\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe:Zone.Identifier

C:\Program Files (x86)\Windows Portable Devices\24dbde2999530e

C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe

C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe:Zone.Identifier

C:\Program Files\Google\Chrome\Application\117.0.5938.132\27d1bcfc3c54e0

C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe

C:\Program Files\Google\Chrome\Application\117.0.5938.132\System.exe:Zone.Identifier

C:\Program Files\Google\Chrome\Application\8b5d9cd934bf30

C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe

C:\Program Files\Google\Chrome\Application\DLNpvJWaIHlCSYcBbohUXVmmYadyUp.exe:Zone.Identifier

C:\Program Files\Internet Explorer\SIGNUP\5940a34987c991

C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe

C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe:Zone.Identifier

C:\ProgramData\SoftwareDistribution\8b5d9cd934bf30

Windows Analysis Report
umPJEpnOgL.exe