Windows Analysis Report
MT_80362_72605XLS.exe

Overview

General Information

Sample name: MT_80362_72605XLS.exe
Analysis ID: 1465483
MD5: f362e538a7ba343bc0b263549c105623
SHA1: b70b3aae17c704cb571a9e03c27651c792b18f3b
SHA256: cc4b5d5653d7dafb9cda51793a15ee5d987b82d3e62e97b3915e5032e7ae4f8e
Tags: exeSnakeKeylogger
Infos:

Detection

PureLog Stealer, Snake Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected PureLog Stealer
Yara detected Snake Keylogger
.NET source code contains potential unpacker
AI detected suspicious sample
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ipconfig to lookup or modify the Windows network settings
Yara detected Costura Assembly Loader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to detect virtual machines (SLDT)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: MT_80362_72605XLS.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Avira: detection malicious, Label: HEUR/AGEN.1313077
Found malware configuration
Source: 0000000C.00000002.4156284355.00000293BEB10000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "sendxambro@educt.shop", "Password": "ABwuRZS5Mjh5", "Host": "educt.shop", "Port": "587"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\Npadosix.exe ReversingLabs: Detection: 39%
Multi AV Scanner detection for submitted file
Source: MT_80362_72605XLS.exe ReversingLabs: Detection: 39%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: MT_80362_72605XLS.exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49722 version: TLS 1.0
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49739 version: TLS 1.0
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49753 version: TLS 1.0
Source: MT_80362_72605XLS.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: MT_80362_72605XLS.exe, 00000000.00000002.3730661753.000001C2664A0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EB15000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D95C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A60AB000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E705000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: MT_80362_72605XLS.exe, 00000000.00000002.3730661753.000001C2664A0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EB15000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D95C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A60AB000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E705000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 4x nop then jmp 00007FF848F0AE45h 8_2_00007FF848F0AACC
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 4x nop then jmp 00007FF848F0A82Bh 8_2_00007FF848F0A572
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 4x nop then jmp 00007FF848F0AE45h 8_2_00007FF848F0AD61
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Code function: 4x nop then jmp 00007FF848F2AE45h 20_2_00007FF848F2AACC
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Code function: 4x nop then jmp 00007FF848F2A82Bh 20_2_00007FF848F2A572
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Code function: 4x nop then jmp 00007FF848F2AE45h 20_2_00007FF848F2AD61
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189Connection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 78.111.67.189 78.111.67.189
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 158.101.44.242 158.101.44.242
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
May check the online IP address of the machine
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: reallyfreegeoip.org
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49722 version: TLS 1.0
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49739 version: TLS 1.0
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49753 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: unknown TCP traffic detected without corresponding DNS query: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /del/Drsoyhfsam.mp3 HTTP/1.1Host: 78.111.67.189Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D78F000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D6E1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5C91000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E6D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://78.111.67.189
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D6E1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5C91000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E6A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://78.111.67.189/del/Drsoyhfsam.mp3
Source: MT_80362_72605XLS.exe, Npadosix.exe.0.dr String found in binary or memory: http://78.111.67.189/del/Drsoyhfsam.mp3QYnagrycsn.Connections.UtilsMockConnector
Source: MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B91FA000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B90D5000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B9179000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B91E7000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B919F000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B91B2000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B918C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E146C1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E1469B000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E146D4000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E145F6000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E1470B000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780103000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801A7000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801BA000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801CE000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801E1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780229000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: Npadosix.exe, 00000018.00000002.4444484916.00000217801A7000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801BA000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780151000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217800F2000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801CE000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801F5000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801E1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780229000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B8FD1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E144F1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: MT_80362_72605XLS.exe, 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4442333207.000000014001B000.00000040.00000400.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4156284355.00000293BEB10000.00000004.00000020.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7333000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4344064393.000001AE47594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B91FA000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B9179000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B91E7000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B919F000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B90F5000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B91B2000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B918C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E146C1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E1469B000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E146D4000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E14617000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E1470B000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780123000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801A7000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801BA000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801CE000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801E1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780229000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D6E1000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B8FD1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5C91000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E6D0000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E144F1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Npadosix.exe, 00000014.00000002.4458281781.0000023E1469B000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E146D4000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E145F6000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E1470B000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780103000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801A7000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801BA000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780151000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801CE000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.00000217801E1000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780229000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: MT_80362_72605XLS.exe, 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B90D5000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4442333207.000000014001B000.00000040.00000400.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4156284355.00000293BEB10000.00000004.00000020.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7333000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4344064393.000001AE47594000.00000004.00000020.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E145F6000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Npadosix.exe, 00000018.00000002.4444484916.0000021780217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: Npadosix.exe, 00000018.00000002.4444484916.00000217801BA000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780151000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33Oc
Source: MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B90D5000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E145F6000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000018.00000002.4444484916.0000021780103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33p
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DB1A000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D8A9000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A60AB000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5E46000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2EABC000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000C.00000002.4156284355.00000293BEB10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000C.00000002.4156284355.00000293BEB10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000008.00000002.4442333207.000000014001B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000010.00000002.4344064393.000001AE47594000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000010.00000002.4344064393.000001AE47594000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000C.00000002.4141526679.00000293B7333000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000C.00000002.4141526679.00000293B7333000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: MT_80362_72605XLS.exe PID: 6052, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MT_80362_72605XLS.exe PID: 6052, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: MT_80362_72605XLS.exe PID: 528, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Npadosix.exe PID: 5812, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Npadosix.exe PID: 5812, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Npadosix.exe PID: 6284, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Npadosix.exe PID: 6284, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process Stats: CPU usage > 49%
PE file does not import any functions
Source: MT_80362_72605XLS.exe Static PE information: No import functions for PE file found
Source: Npadosix.exe.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: MT_80362_72605XLS.exe, 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefbXfjPLUOxpHounQOLpg.exeX vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefbXfjPLUOxpHounQOLpg.exeX vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3730661753.000001C2664A0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMT_80362_72605.exeB vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefbXfjPLUOxpHounQOLpg.exeX vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000000.1980494694.000001C24B9A6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameMT_80362_72605.exeB vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E0EF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameYnagrycsn.dll" vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3728450877.000001C265FE0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameYnagrycsn.dll" vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EB15000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D95C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs MT_80362_72605XLS.exe
Source: MT_80362_72605XLS.exe Binary or memory string: OriginalFilenameMT_80362_72605.exeB vs MT_80362_72605XLS.exe
Yara signature match
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000C.00000002.4156284355.00000293BEB10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000C.00000002.4156284355.00000293BEB10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000008.00000002.4442333207.000000014001B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000010.00000002.4344064393.000001AE47594000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000010.00000002.4344064393.000001AE47594000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000C.00000002.4141526679.00000293B7333000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000C.00000002.4141526679.00000293B7333000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: MT_80362_72605XLS.exe PID: 6052, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MT_80362_72605XLS.exe PID: 6052, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: MT_80362_72605XLS.exe PID: 528, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Npadosix.exe PID: 5812, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Npadosix.exe PID: 5812, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Npadosix.exe PID: 6284, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Npadosix.exe PID: 6284, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, ITaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, TaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, Task.cs Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, TaskService.cs Task registration methods: 'CreateFromToken'
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, Task.cs Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, TaskSecurity.cs Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, TaskSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, TaskPrincipal.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, TaskFolder.cs Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, User.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@39/4@2/3
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe File created: C:\Users\user\AppData\Roaming\Npadosix.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3124:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3596:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4320:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5640:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03
Source: MT_80362_72605XLS.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: MT_80362_72605XLS.exe Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B92E0000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4473063649.00000226C905D000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B9293000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B92B1000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B92ED000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4451203134.00000226B92A2000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E147AC000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E147BB000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E14805000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000014.00000002.4458281781.0000023E147F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MT_80362_72605XLS.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe File read: C:\Users\user\Desktop\MT_80362_72605XLS.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\MT_80362_72605XLS.exe "C:\Users\user\Desktop\MT_80362_72605XLS.exe"
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /release
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process created: C:\Users\user\Desktop\MT_80362_72605XLS.exe "C:\Users\user\Desktop\MT_80362_72605XLS.exe"
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /renew
Source: unknown Process created: C:\Users\user\AppData\Roaming\Npadosix.exe "C:\Users\user\AppData\Roaming\Npadosix.exe"
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /release
Source: unknown Process created: C:\Users\user\AppData\Roaming\Npadosix.exe "C:\Users\user\AppData\Roaming\Npadosix.exe"
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Users\user\AppData\Roaming\Npadosix.exe "C:\Users\user\AppData\Roaming\Npadosix.exe"
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Users\user\AppData\Roaming\Npadosix.exe "C:\Users\user\AppData\Roaming\Npadosix.exe"
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /renew
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process created: C:\Users\user\Desktop\MT_80362_72605XLS.exe "C:\Users\user\Desktop\MT_80362_72605XLS.exe" Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /release Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /renew Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Users\user\AppData\Roaming\Npadosix.exe "C:\Users\user\AppData\Roaming\Npadosix.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Users\user\AppData\Roaming\Npadosix.exe "C:\Users\user\AppData\Roaming\Npadosix.exe"
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /release
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /renew
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /renew
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\ipconfig.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\ipconfig.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\ipconfig.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\ipconfig.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: MT_80362_72605XLS.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: MT_80362_72605XLS.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: MT_80362_72605XLS.exe, 00000000.00000002.3730661753.000001C2664A0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EB15000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D95C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A60AB000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E705000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: MT_80362_72605XLS.exe, 00000000.00000002.3730661753.000001C2664A0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EB15000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D95C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A60AB000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E705000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3730413329.000001C2662D0000.00000004.08000000.00040000.00000000.sdmp, MT_80362_72605XLS.exe, 00000000.00000002.3715601083.000001C25EA56000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B7226000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.MT_80362_72605XLS.exe.1c25eac5590.11.raw.unpack, XmlSerializationHelper.cs .Net Code: ReadObjectProperties
Source: 0.2.MT_80362_72605XLS.exe.1c25ea56ee8.14.raw.unpack, TypeModel.cs .Net Code: TryDeserializeList
Source: 0.2.MT_80362_72605XLS.exe.1c25ea56ee8.14.raw.unpack, ListDecorator.cs .Net Code: Read
Source: 0.2.MT_80362_72605XLS.exe.1c25ea56ee8.14.raw.unpack, TypeSerializer.cs .Net Code: CreateInstance
Source: 0.2.MT_80362_72605XLS.exe.1c25ea56ee8.14.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateInstance
Source: 0.2.MT_80362_72605XLS.exe.1c25ea56ee8.14.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateIfNull
Source: 0.2.MT_80362_72605XLS.exe.1c2662d0000.18.raw.unpack, TypeModel.cs .Net Code: TryDeserializeList
Source: 0.2.MT_80362_72605XLS.exe.1c2662d0000.18.raw.unpack, ListDecorator.cs .Net Code: Read
Source: 0.2.MT_80362_72605XLS.exe.1c2662d0000.18.raw.unpack, TypeSerializer.cs .Net Code: CreateInstance
Source: 0.2.MT_80362_72605XLS.exe.1c2662d0000.18.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateInstance
Source: 0.2.MT_80362_72605XLS.exe.1c2662d0000.18.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateIfNull
Yara detected Costura Assembly Loader
Source: Yara match File source: 12.2.Npadosix.exe.293b705fe08.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e8909d0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e868998.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e8909d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e868998.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Npadosix.exe.1ae2ea13ca0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293a6002250.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b7037dd0.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b714fe78.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c266270000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b705fe08.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293a6002250.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b7037dd0.14.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e980a40.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Npadosix.exe.1ae2ea13ca0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3730094196.000001C266270000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3715601083.000001C25E980000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4141526679.00000293B6DAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3712415322.000001C24D8A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4141526679.00000293B714F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3715601083.000001C25E5DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4133887418.00000293A5E46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4331560231.000001AE2E705000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MT_80362_72605XLS.exe PID: 6052, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 5812, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 6284, type: MEMORYSTR
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF848F48123 push ebx; ret 0_2_00007FF848F4816A
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF848F46682 push eax; retf 0_2_00007FF848F46683
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF848F46692 pushad ; retf 0_2_00007FF848F46693
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF848F400BD pushad ; iretd 0_2_00007FF848F400C1
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF848F4671A push eax; iretd 0_2_00007FF848F4671B
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF848F4672A pushad ; iretd 0_2_00007FF848F4672B
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F3A35 push ebx; retn 0001h 0_2_00007FF8491F3A53
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F0E05 pushfd ; retn 0001h 0_2_00007FF8491F0E22
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F4695 push ebx; retn 0001h 0_2_00007FF8491F46B3
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F3AC5 push ebx; retn 0001h 0_2_00007FF8491F3AE3
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F3D05 push ebx; retn 0001h 0_2_00007FF8491F3D23
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F4D05 push ebx; retn 0001h 0_2_00007FF8491F4D2B
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F39A5 push ebx; retn 0001h 0_2_00007FF8491F39C3
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F4DC5 push ebx; retn 0001h 0_2_00007FF8491F4DE3
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F3C75 push ebx; retn 0001h 0_2_00007FF8491F3C93
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F4845 push ebx; retn 0001h 0_2_00007FF8491F4863
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F4455 push ebx; retn 0001h 0_2_00007FF8491F4473
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F14A9 pushfd ; retn 0001h 0_2_00007FF8491F14CA
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F40F5 push ebx; retn 0001h 0_2_00007FF8491F4113
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F48D5 push ebx; retn 0001h 0_2_00007FF8491F48F3
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F4725 push ebx; retn 0001h 0_2_00007FF8491F4743
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F4B75 push ebx; retn 0001h 0_2_00007FF8491F4B9B
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF8491F47B5 push ebx; retn 0001h 0_2_00007FF8491F47D3
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF849207B23 push eax; ret 0_2_00007FF849207B25
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF849206701 pushad ; ret 0_2_00007FF849206702
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF849206708 pushad ; ret 0_2_00007FF849206709
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 0_2_00007FF849209F9E push eax; retf 0_2_00007FF849209F9F
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 8_2_00007FF848F0A518 push eax; iretd 8_2_00007FF848F0A519
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 8_2_00007FF848F0322D push E95C9EDDh; ret 8_2_00007FF848F03279
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Code function: 8_2_00007FF848F000BD pushad ; iretd 8_2_00007FF848F000C1
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Code function: 12_2_00007FF848F2812B push ebx; ret 12_2_00007FF848F2816A

Persistence and Installation Behavior
barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /release
Drops PE files
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe File created: C:\Users\user\AppData\Roaming\Npadosix.exe Jump to dropped file
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Npadosix Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Npadosix Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: MT_80362_72605XLS.exe, 00000000.00000002.3712415322.000001C24D8A9000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4133887418.00000293A5E46000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4331560231.000001AE2E705000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Memory allocated: 1C24BC10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Memory allocated: 1C2656E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Memory allocated: 226B7550000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Memory allocated: 226D0FD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Memory allocated: 293A44C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Memory allocated: 293BDC90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Memory allocated: 1AE2CF70000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Memory allocated: 1AE466A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Memory allocated: 23E12A20000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Memory allocated: 23E2C4F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Memory allocated: 217FAA30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Memory allocated: 217FC180000 memory reserve | memory write watch
Contains functionality to detect virtual machines (SLDT)
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Code function: 12_2_00007FF8491EF320 sldt word ptr [eax] 12_2_00007FF8491EF320
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599765 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599422 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599313 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599188 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599078 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598969 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598844 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598723 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598594 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598479 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598364 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598234 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598125 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597987 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597859 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597750 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597641 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597516 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597391 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597281 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597172 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597063 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596938 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596813 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596702 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596594 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596469 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596359 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596250 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596140 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596031 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595922 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595813 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595688 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595578 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595469 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595344 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595234 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595125 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595014 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594906 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594794 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594687 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594578 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594469 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594344 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599641
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599516
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599407
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599282
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599157
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599047
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598813
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598688
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598563
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598438
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597829
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597579
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597454
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596829
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596579
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596454
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595829
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595579
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595454
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594829
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594579
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594454
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 593954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599891
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599782
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599663
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599547
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599438
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599321
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598829
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598579
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598454
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597966
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597844
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597735
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597625
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597485
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597375
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597266
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597125
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597016
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596907
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596782
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596657
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596532
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596407
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596282
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596172
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596047
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595938
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595828
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595584
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595469
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595359
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595249
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595138
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595032
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594907
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594797
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594688
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594563
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594438
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594313
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594188
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Window / User API: threadDelayed 8064 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Window / User API: threadDelayed 1796 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Window / User API: threadDelayed 5013 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Window / User API: threadDelayed 4827 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Window / User API: threadDelayed 1243 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Window / User API: threadDelayed 3523 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Window / User API: threadDelayed 7747
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Window / User API: threadDelayed 2087
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Window / User API: threadDelayed 3296
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Window / User API: threadDelayed 6519
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Window / User API: threadDelayed 5785
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Window / User API: threadDelayed 4039
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep count: 36 > 30 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -33204139332677172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3436 Thread sleep count: 8064 > 30 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3436 Thread sleep count: 1796 > 30 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -99875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -99765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -99656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -99547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -99437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -99325s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -99219s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -99109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -98999s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -98875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -98765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -98632s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -98531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -98417s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -98312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -98203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -98094s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -97984s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -97875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -97766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -97656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -97547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -97437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -97328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -97219s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -97094s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -96984s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -96875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -96766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -96656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -96547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -96437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -96327s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -96219s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -96094s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -95984s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -95875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -95765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -95656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -95547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -95437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -95328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -95218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -95109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -95000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -94890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 4752 Thread sleep time: -94781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -34126476536362649s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -599875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 6196 Thread sleep count: 5013 > 30 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 6196 Thread sleep count: 4827 > 30 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -599765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -599656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -599547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -599422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -599313s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -599188s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -599078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -598969s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -598844s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -598723s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -598594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -598479s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -598364s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -598234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -598125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -597987s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -597859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -597750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -597641s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -597516s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -597391s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -597281s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -597172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -597063s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -596938s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -596813s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -596702s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -596594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -596469s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -596359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -596250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -596140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -596031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -595922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -595813s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -595688s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -595578s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -595469s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -595344s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -595234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -595125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -595014s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -594906s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -594794s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -594687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -594578s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -594469s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe TID: 3668 Thread sleep time: -594344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -15679732462653109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3784 Thread sleep count: 1243 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3784 Thread sleep count: 3523 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -99890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -99780s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -99661s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -99532s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -99407s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -99282s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -99157s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -99032s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -98907s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -98797s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -98688s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -98563s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -98438s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -98316s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -98188s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -98078s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -97969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -97844s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -97735s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2888 Thread sleep time: -97610s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2700 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -35971150943733603s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 1352 Thread sleep count: 7747 > 30
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 1308 Thread sleep count: 2087 > 30
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -99671s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -99563s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -99453s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -99344s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -99234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -99125s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -99015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -98906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -98797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -98688s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -98563s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -98438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -98327s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -98219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -98094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -97985s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -97860s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -97735s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -97610s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -97485s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -97360s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -97235s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -97110s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -96985s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -96860s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -96735s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -96610s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -96485s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -96360s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -96235s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -96110s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -95985s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -95860s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -95735s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -95610s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -95485s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -95360s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -95235s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -95110s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -94985s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -94860s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -94735s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -94610s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -94485s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 6756 Thread sleep time: -94360s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -26747778906878833s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 4084 Thread sleep count: 3296 > 30
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 4084 Thread sleep count: 6519 > 30
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -599766s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -599641s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -599516s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -599407s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -599282s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -599157s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -599047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -598938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -598813s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -598688s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -598563s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -598438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -598329s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -598204s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -598079s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -597954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -597829s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -597704s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -597579s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -597454s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -597329s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -597204s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -597079s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -596954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -596829s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -596704s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -596579s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -596454s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -596329s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -596204s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -596079s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -595954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -595829s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -595704s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -595579s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -595454s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -595329s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -595204s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -595079s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -594954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -594829s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -594704s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -594579s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -594454s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -594329s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -594204s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -594079s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 3588 Thread sleep time: -593954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -599891s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2060 Thread sleep count: 5785 > 30
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2060 Thread sleep count: 4039 > 30
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -599782s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -599663s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -599547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -599438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -599321s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -599204s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -599079s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -598954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -598829s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -598704s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -598579s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -598454s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -598329s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -598204s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -598079s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -597966s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -597844s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -597735s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -597625s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -597485s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -597375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -597266s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -597125s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -597016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -596907s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -596782s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -596657s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -596532s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -596407s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -596282s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -596172s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -596047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -595938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -595828s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -595704s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -595584s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -595469s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -595359s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -595249s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -595138s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -595032s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -594907s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -594797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -594688s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -594563s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -594438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -594313s >= -30000s
Source: C:\Users\user\AppData\Roaming\Npadosix.exe TID: 2676 Thread sleep time: -594188s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 99875 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 99765 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 99656 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 99547 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 99437 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 99325 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 99219 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 99109 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 98999 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 98875 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 98765 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 98632 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 98531 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 98417 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 98312 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 98203 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 98094 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 97984 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 97875 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 97766 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 97656 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 97547 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 97437 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 97328 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 97219 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 97094 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 96984 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 96875 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 96766 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 96656 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 96547 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 96437 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 96327 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 96219 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 96094 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 95984 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 95875 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 95765 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 95656 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 95547 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 95437 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 95328 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 95218 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 95109 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 95000 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 94890 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 94781 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599765 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599422 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599313 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599188 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 599078 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598969 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598844 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598723 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598594 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598479 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598364 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598234 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 598125 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597987 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597859 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597750 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597641 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597516 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597391 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597281 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597172 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 597063 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596938 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596813 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596702 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596594 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596469 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596359 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596250 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596140 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 596031 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595922 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595813 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595688 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595578 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595469 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595344 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595234 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595125 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 595014 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594906 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594794 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594687 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594578 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594469 Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread delayed: delay time: 594344 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99890 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99780 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99661 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99532 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99407 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99282 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99157 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99032 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98907 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98797 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98688 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98563 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98438 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98316 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98188 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98078 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97969 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97844 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97735 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97610 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99671
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99563
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99453
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99344
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99234
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99125
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 99015
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98906
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98797
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98688
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98563
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98438
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98327
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98219
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 98094
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97985
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97860
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97735
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97610
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97485
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97360
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97235
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 97110
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 96985
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 96860
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 96735
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 96610
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 96485
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 96360
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 96235
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 96110
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 95985
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 95860
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 95735
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 95610
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 95485
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 95360
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 95235
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 95110
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 94985
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 94860
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 94735
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 94610
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 94485
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 94360
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599641
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599516
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599407
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599282
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599157
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599047
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598813
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598688
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598563
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598438
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597829
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597579
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597454
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596829
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596579
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596454
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595829
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595579
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595454
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594829
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594579
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594454
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 593954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599891
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599782
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599663
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599547
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599438
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599321
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 599079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598954
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598829
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598579
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598454
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598329
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598204
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 598079
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597966
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597844
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597735
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597625
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597485
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597375
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597266
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597125
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 597016
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596907
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596782
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596657
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596532
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596407
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596282
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596172
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 596047
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595938
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595828
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595704
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595584
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595469
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595359
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595249
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595138
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 595032
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594907
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594797
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594688
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594563
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594438
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594313
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread delayed: delay time: 594188
Source: Npadosix.exe, 00000010.00000002.4331560231.000001AE2E705000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SerialNumber0VMware|VIRTUAL|A M I|XenDselect * from Win32_ComputerSystem
Source: Npadosix.exe, 00000010.00000002.4331560231.000001AE2E705000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: model0Microsoft|VMWare|Virtual
Source: Npadosix.exe, 0000000C.00000002.4155898841.00000293BE5C1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: MT_80362_72605XLS.exe, 00000000.00000002.3710601639.000001C24BCFD000.00000004.00000020.00020000.00000000.sdmp, MT_80362_72605XLS.exe, 00000008.00000002.4444352095.00000226B744D000.00000004.00000020.00020000.00000000.sdmp, Npadosix.exe, 0000000C.00000002.4131983641.00000293A42C2000.00000004.00000020.00020000.00000000.sdmp, Npadosix.exe, 00000010.00000002.4329678456.000001AE2CD71000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Npadosix.exe, 00000014.00000002.4445600011.0000023E12918000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlldd
Source: Npadosix.exe, 00000018.00000002.4462076885.00000217FA6C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll))
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Memory written: C:\Users\user\Desktop\MT_80362_72605XLS.exe base: 140000000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Memory written: C:\Users\user\AppData\Roaming\Npadosix.exe base: 140000000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Memory written: C:\Users\user\AppData\Roaming\Npadosix.exe base: 140000000 value starts with: 4D5A
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Thread register set: target process: 528 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread register set: target process: 7004 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Thread register set: target process: 2368
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process created: C:\Users\user\Desktop\MT_80362_72605XLS.exe "C:\Users\user\Desktop\MT_80362_72605XLS.exe" Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /release Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /renew Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Users\user\AppData\Roaming\Npadosix.exe "C:\Users\user\AppData\Roaming\Npadosix.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Users\user\AppData\Roaming\Npadosix.exe "C:\Users\user\AppData\Roaming\Npadosix.exe"
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /release
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /renew
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /renew
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Queries volume information: C:\Users\user\Desktop\MT_80362_72605XLS.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Queries volume information: C:\Users\user\Desktop\MT_80362_72605XLS.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Queries volume information: C:\Users\user\AppData\Roaming\Npadosix.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Queries volume information: C:\Users\user\AppData\Roaming\Npadosix.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Queries volume information: C:\Users\user\AppData\Roaming\Npadosix.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Queries volume information: C:\Users\user\AppData\Roaming\Npadosix.exe VolumeInformation
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c265fe0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c265fe0000.16.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b6b7c830.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25db302f8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e3ad3f8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e3ad3f8.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e18dfb8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b6b7c830.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e18dfb8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25db302f8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.4141526679.00000293B6B7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3728450877.000001C265FE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3715601083.000001C25E0EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3715601083.000001C25D6EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Snake Keylogger
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.4444484916.000002178023C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4156284355.00000293BEB10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4442333207.000000014001B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.4442336121.000000014001A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.4458281781.0000023E1470B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4451203134.00000226B8FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4344064393.000001AE47594000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4451203134.00000226B920D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.4444484916.0000021780001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4141526679.00000293B7333000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.4458281781.0000023E144F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MT_80362_72605XLS.exe PID: 6052, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MT_80362_72605XLS.exe PID: 528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 5812, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 6284, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 7004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 2368, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\Npadosix.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\Npadosix.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\MT_80362_72605XLS.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Npadosix.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\Npadosix.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Yara detected Credential Stealer
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4156284355.00000293BEB10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4344064393.000001AE47594000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4141526679.00000293B7333000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MT_80362_72605XLS.exe PID: 6052, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MT_80362_72605XLS.exe PID: 528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 5812, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 6284, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 7004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 2368, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c265fe0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c265fe0000.16.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b6b7c830.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25db302f8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e3ad3f8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e3ad3f8.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e18dfb8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b6b7c830.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25e18dfb8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25db302f8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.4141526679.00000293B6B7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3728450877.000001C265FE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3715601083.000001C25E0EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3715601083.000001C25D6EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Snake Keylogger
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b7333238.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Npadosix.exe.293b7333238.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT_80362_72605XLS.exe.1c25eb98038.15.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.4444484916.000002178023C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3712415322.000001C24DA4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3715601083.000001C25EB66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4156284355.00000293BEB10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.3730955331.000001C266549000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4442333207.000000014001B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.4442336121.000000014001A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4331560231.000001AE2E998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.4458281781.0000023E1470B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4451203134.00000226B8FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4344064393.000001AE47594000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4451203134.00000226B920D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.4444484916.0000021780001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4141526679.00000293B7333000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.4458281781.0000023E144F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.4133887418.00000293A5F5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MT_80362_72605XLS.exe PID: 6052, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MT_80362_72605XLS.exe PID: 528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 5812, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 6284, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 7004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npadosix.exe PID: 2368, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1465483 Sample: MT_80362_72605XLS.exe Startdate: 01/07/2024 Architecture: WINDOWS Score: 100 65 reallyfreegeoip.org 2->65 67 checkip.dyndns.org 2->67 69 checkip.dyndns.com 2->69 79 Found malware configuration 2->79 81 Malicious sample detected (through community Yara rule) 2->81 83 Antivirus / Scanner detection for submitted sample 2->83 87 9 other signatures 2->87 8 MT_80362_72605XLS.exe 15 6 2->8         started        13 Npadosix.exe 14 4 2->13         started        15 Npadosix.exe 2->15         started        signatures3 85 Tries to detect the country of the analysis system (by using the IP) 65->85 process4 dnsIp5 71 78.111.67.189, 49704, 49712, 49713 SURFPLANET-ASDE Germany 8->71 55 C:\Users\user\AppData\Roaming55padosix.exe, PE32+ 8->55 dropped 57 C:\Users\...57padosix.exe:Zone.Identifier, ASCII 8->57 dropped 59 C:\Users\user\...\MT_80362_72605XLS.exe.log, CSV 8->59 dropped 89 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->89 91 Modifies the context of a thread in another process (thread injection) 8->91 93 Injects a PE file into a foreign processes 8->93 17 MT_80362_72605XLS.exe 2 8->17         started        21 cmd.exe 1 8->21         started        23 cmd.exe 1 8->23         started        95 Antivirus detection for dropped file 13->95 97 Multi AV Scanner detection for dropped file 13->97 99 Machine Learning detection for dropped file 13->99 25 Npadosix.exe 13->25         started        27 cmd.exe 13->27         started        29 cmd.exe 13->29         started        31 Npadosix.exe 15->31         started        33 cmd.exe 15->33         started        35 cmd.exe 15->35         started        file6 signatures7 process8 dnsIp9 61 reallyfreegeoip.org 188.114.97.3, 443, 49722, 49723 CLOUDFLARENETUS European Union 17->61 63 checkip.dyndns.com 158.101.44.242, 49721, 49724, 49726 ORACLE-BMC-31898US United States 17->63 73 Uses ipconfig to lookup or modify the Windows network settings 21->73 37 conhost.exe 21->37         started        39 ipconfig.exe 1 21->39         started        41 conhost.exe 23->41         started        43 ipconfig.exe 1 23->43         started        75 Tries to steal Mail credentials (via file / registry access) 25->75 77 Tries to harvest and steal browser information (history, passwords, etc) 25->77 45 conhost.exe 27->45         started        47 ipconfig.exe 27->47         started        49 2 other processes 29->49 51 2 other processes 33->51 53 2 other processes 35->53 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
78.111.67.189
 unknown Germany
33984 SURFPLANET-ASDE false
188.114.97.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
158.101.44.242
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.97.3 true
checkip.dyndns.com 158.101.44.242 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://checkip.dyndns.org/ false
  • Avira URL Cloud: safe
 unknown
http://78.111.67.189/del/Drsoyhfsam.mp3 false
  • Avira URL Cloud: safe
 unknown
https://reallyfreegeoip.org/xml/8.46.123.33 false
  • Avira URL Cloud: safe
 unknown