Windows Analysis Report
oIDX88LpSs.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.0.MyNigga!.exe.9b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.oIDX88LpSs.exe.2b42068.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.2110723473.00000000009B2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2113525590.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\FluxusV1.2, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\SIHClient.exe	File created: C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMP69BD.tmp
Source: C:\Windows\System32\SIHClient.exe	File created: C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMPA192.tmp
Source: C:\Windows\System32\SIHClient.exe	File created: C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP1BA5.tmp

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Code function: 2_2_00007FFD346F9092	2_2_00007FFD346F9092
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Code function: 2_2_00007FFD346F186D	2_2_00007FFD346F186D
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Code function: 2_2_00007FFD346F7ED6	2_2_00007FFD346F7ED6
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Code function: 2_2_00007FFD346F2059	2_2_00007FFD346F2059
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346E6DB8	3_2_00007FFD346E6DB8
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346E6DB0	3_2_00007FFD346E6DB0
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346EE898	3_2_00007FFD346EE898
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346F2AB0	3_2_00007FFD346F2AB0
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346F25D3	3_2_00007FFD346F25D3
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346F95A9	3_2_00007FFD346F95A9
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346E4928	3_2_00007FFD346E4928
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346FAC11	3_2_00007FFD346FAC11

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe EBBCB489171ABFCFCE56554DBAEACD22A15838391CBC7C756DB02995129DEF5A

Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7084 -s 2188

Source: oIDX88LpSs.exe, 00000000.00000002.2113525590.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMyNigga!.exe4 vs oIDX88LpSs.exe
Source: oIDX88LpSs.exe	Binary or memory string: OriginalFilenameOutput.exe4 vs oIDX88LpSs.exe

Source: oIDX88LpSs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.0.MyNigga!.exe.9b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.oIDX88LpSs.exe.2b42068.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.2110723473.00000000009B2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2113525590.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\FluxusV1.2, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: oIDX88LpSs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: oIDX88LpSs.exe, 6erNU9GoRtGQsFcnnrGTGgBTl1yaTwHR6rinJwi9plL4REYW5dMRtyPsdevOJ0m8ncPWxIZGM.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: MyNigga!.exe.0.dr, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: MyNigga!.exe.0.dr, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: MyNigga!.exe.0.dr, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: FluxusV1.2.2.dr, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: MyNigga!.exe.0.dr, lCnryOV9jmTEZuL5mPAIjPEDs3WY2hwiIPCV4RgbEJYqGbLYpIsXHsN095G.cs	Base64 encoded string: 'QiamGmoEX3zEaiB7jomxiUiYlXdBll5VNvZCONfJJZT7dzhp6icN2T0XBSCP6JZ32RnNjTrfhEGL', 'VEo6kE4Eu88feqz2TnuNxCe1Wt6pMJBPZBLiAs4Jit1Vl84oc2p7HE7ubS236xkqjKMPu8yXQ220', 'pFDHTv8dzmVT5cdhzPqeeKrTanQRN4jU2ZDKzDbflH73hUpwrH5m7ZenRTP3kBpSxj7xKORs3vb8', 'iJYJct2SVfOBjRpftkVpnvThpW1lrWn9wyDrevufVA5PSHEi8k1ZwLJcfwjh1AAIK97pyFr1qFbO', 'Gmw5GJMmljKoqMNZYZQByiOD688GiJ8kS47841pVbbXt2gOyrO9VBl303Fp6A2AHq6hOQVWfbo3I', 'NTKYezmNFmEoTmei08SYHSgPIA1WhICauFeY7tUmFPHg3uZEo25bCFsiqDEA8f5H3EsdPaM1Cfry', 'HgC1rTjd6Mygu5q4XdhcwwUf5o8CkqkoYdK4xAhQcNK0Xl5SkhBS5SvewRBDIOhT8Kvr56n9XN8j', 'tQDEQ7YXSe3VKPsJIIhiuNBm2rTEDgL7hcIxMA1pxJoCTQMIJZci5oNLkICmYpwyT7AFjqSxPS8c', 'nEme1xg0XjwMt931qDVMlHcmbVAF3AfP3vEEMnmwCPLAjtFfHWqEXAkDPfv7O4TqeMVHf7SYU6K9', 'UubGsrWmXp9Wbo35FHOgRy2tq6A6swsVT1gQG8kMZJntJ9xCNnUYacvDBSPJZo7HKhLAlz60TEam'
Source: MyNigga!.exe.0.dr, ScbHcjkL7WWFyToAiCRaf56oKTSNfj51ak47Dj2qXVEu59Hst3poaCdYaMT.cs	Base64 encoded string: 'vyXwoJkwKvsIzP7BGaLnMN4sF818fDahmlRYMYbwvHYPaL0xY7b3BBG2JO9WSaB4y0aF0hxzTuA6', 'VFMlywpvMizqrVkcb7eSrij3TET1496k8eJsf0QqakJT8RPOSblDhhcJpU7n9qymF8qkjDQLbLHO', 'iM9Tn4I1zTKWORK66Y7qAfqeeic8p9pSiC8UFS1W7nlcnuadF1q97eq8mr5abdNVc1OrwThvvfhD'
Source: MyNigga!.exe.0.dr, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	Base64 encoded string: 'Qia3JH5ymF4uaot3NOgNGEc2iJqN9Yz61iNWNXofusbPwKpWHLo652S9dPDQfxG97PWrtffubGbD', 'tvYpjF0Fhr1T7jvAXq1ftkzOAcIOVxZh80V69WF9xlcAFdBrIEON1yXC0eMGKdOAmekK0kvg1632'
Source: MyNigga!.exe.0.dr, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	Base64 encoded string: 'rtxq5Rof5VoK1gUZBqQBCqYhJ5aIvZmIb2eGxnrlmOGOSvSmfQHBJL0EQd9R5ohd5NItSCijh1rv', 'x5RLU7OBqzlw1QybpIx5MhdSJNBz23u90nG367hmWm8BBqSe1g80LHWgl8NorbWtCqAx6q25XBrx', 'XUr0GkELP964gE0qbsFOecveuCGbaGPoSBqdaskJtLMd0qyYLa498rDBWJ5e5PYnBjJQYEYRl6HT', 'ZLxfcNUPqaZWJtIsJpxbiTIjhAriL5OcI9G5ycHNrMdU0nTZLrl2Dn3H5YSK7OyBxlgnHr5XTb9c', 'Le0FQcDbNUoDNQtOwagaZDMdywgQBY5WxGhuLBZLREnV1NQnJkcV74Z9kEj3vQbJpRfIhi0wt4uy', 'KgVv2gYZOCy9II0A0VYHeo2tvMef1X9YtlnmlpSN1TsMqcRVnUUo8k7eIuZOf20E22b27Eyb1VIS', 'ScRFWcLIiLeHtPcypfhWfvXhxfO7i9SslqIHtZ6kd74Nimh8X81Tq7cdNUVqbapzr2BmQ4p5XHmB', 'MpIf5hgk8GifrzO7jaRErduFRd4yvWxzCTcvErgMhnDkWmo6MziCxUHy2GcFtqfbte9rackeK72E', 'R7RyBRhJpKUJIvDaqEyNV12fLDoXfrahTFW0WdbAl76oh56QtWJIhXIPRfUt9rpp3L98wXepqJJx'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, lCnryOV9jmTEZuL5mPAIjPEDs3WY2hwiIPCV4RgbEJYqGbLYpIsXHsN095G.cs	Base64 encoded string: 'QiamGmoEX3zEaiB7jomxiUiYlXdBll5VNvZCONfJJZT7dzhp6icN2T0XBSCP6JZ32RnNjTrfhEGL', 'VEo6kE4Eu88feqz2TnuNxCe1Wt6pMJBPZBLiAs4Jit1Vl84oc2p7HE7ubS236xkqjKMPu8yXQ220', 'pFDHTv8dzmVT5cdhzPqeeKrTanQRN4jU2ZDKzDbflH73hUpwrH5m7ZenRTP3kBpSxj7xKORs3vb8', 'iJYJct2SVfOBjRpftkVpnvThpW1lrWn9wyDrevufVA5PSHEi8k1ZwLJcfwjh1AAIK97pyFr1qFbO', 'Gmw5GJMmljKoqMNZYZQByiOD688GiJ8kS47841pVbbXt2gOyrO9VBl303Fp6A2AHq6hOQVWfbo3I', 'NTKYezmNFmEoTmei08SYHSgPIA1WhICauFeY7tUmFPHg3uZEo25bCFsiqDEA8f5H3EsdPaM1Cfry', 'HgC1rTjd6Mygu5q4XdhcwwUf5o8CkqkoYdK4xAhQcNK0Xl5SkhBS5SvewRBDIOhT8Kvr56n9XN8j', 'tQDEQ7YXSe3VKPsJIIhiuNBm2rTEDgL7hcIxMA1pxJoCTQMIJZci5oNLkICmYpwyT7AFjqSxPS8c', 'nEme1xg0XjwMt931qDVMlHcmbVAF3AfP3vEEMnmwCPLAjtFfHWqEXAkDPfv7O4TqeMVHf7SYU6K9', 'UubGsrWmXp9Wbo35FHOgRy2tq6A6swsVT1gQG8kMZJntJ9xCNnUYacvDBSPJZo7HKhLAlz60TEam'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, ScbHcjkL7WWFyToAiCRaf56oKTSNfj51ak47Dj2qXVEu59Hst3poaCdYaMT.cs	Base64 encoded string: 'vyXwoJkwKvsIzP7BGaLnMN4sF818fDahmlRYMYbwvHYPaL0xY7b3BBG2JO9WSaB4y0aF0hxzTuA6', 'VFMlywpvMizqrVkcb7eSrij3TET1496k8eJsf0QqakJT8RPOSblDhhcJpU7n9qymF8qkjDQLbLHO', 'iM9Tn4I1zTKWORK66Y7qAfqeeic8p9pSiC8UFS1W7nlcnuadF1q97eq8mr5abdNVc1OrwThvvfhD'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	Base64 encoded string: 'Qia3JH5ymF4uaot3NOgNGEc2iJqN9Yz61iNWNXofusbPwKpWHLo652S9dPDQfxG97PWrtffubGbD', 'tvYpjF0Fhr1T7jvAXq1ftkzOAcIOVxZh80V69WF9xlcAFdBrIEON1yXC0eMGKdOAmekK0kvg1632'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	Base64 encoded string: 'rtxq5Rof5VoK1gUZBqQBCqYhJ5aIvZmIb2eGxnrlmOGOSvSmfQHBJL0EQd9R5ohd5NItSCijh1rv', 'x5RLU7OBqzlw1QybpIx5MhdSJNBz23u90nG367hmWm8BBqSe1g80LHWgl8NorbWtCqAx6q25XBrx', 'XUr0GkELP964gE0qbsFOecveuCGbaGPoSBqdaskJtLMd0qyYLa498rDBWJ5e5PYnBjJQYEYRl6HT', 'ZLxfcNUPqaZWJtIsJpxbiTIjhAriL5OcI9G5ycHNrMdU0nTZLrl2Dn3H5YSK7OyBxlgnHr5XTb9c', 'Le0FQcDbNUoDNQtOwagaZDMdywgQBY5WxGhuLBZLREnV1NQnJkcV74Z9kEj3vQbJpRfIhi0wt4uy', 'KgVv2gYZOCy9II0A0VYHeo2tvMef1X9YtlnmlpSN1TsMqcRVnUUo8k7eIuZOf20E22b27Eyb1VIS', 'ScRFWcLIiLeHtPcypfhWfvXhxfO7i9SslqIHtZ6kd74Nimh8X81Tq7cdNUVqbapzr2BmQ4p5XHmB', 'MpIf5hgk8GifrzO7jaRErduFRd4yvWxzCTcvErgMhnDkWmo6MziCxUHy2GcFtqfbte9rackeK72E', 'R7RyBRhJpKUJIvDaqEyNV12fLDoXfrahTFW0WdbAl76oh56QtWJIhXIPRfUt9rpp3L98wXepqJJx'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, lCnryOV9jmTEZuL5mPAIjPEDs3WY2hwiIPCV4RgbEJYqGbLYpIsXHsN095G.cs	Base64 encoded string: 'QiamGmoEX3zEaiB7jomxiUiYlXdBll5VNvZCONfJJZT7dzhp6icN2T0XBSCP6JZ32RnNjTrfhEGL', 'VEo6kE4Eu88feqz2TnuNxCe1Wt6pMJBPZBLiAs4Jit1Vl84oc2p7HE7ubS236xkqjKMPu8yXQ220', 'pFDHTv8dzmVT5cdhzPqeeKrTanQRN4jU2ZDKzDbflH73hUpwrH5m7ZenRTP3kBpSxj7xKORs3vb8', 'iJYJct2SVfOBjRpftkVpnvThpW1lrWn9wyDrevufVA5PSHEi8k1ZwLJcfwjh1AAIK97pyFr1qFbO', 'Gmw5GJMmljKoqMNZYZQByiOD688GiJ8kS47841pVbbXt2gOyrO9VBl303Fp6A2AHq6hOQVWfbo3I', 'NTKYezmNFmEoTmei08SYHSgPIA1WhICauFeY7tUmFPHg3uZEo25bCFsiqDEA8f5H3EsdPaM1Cfry', 'HgC1rTjd6Mygu5q4XdhcwwUf5o8CkqkoYdK4xAhQcNK0Xl5SkhBS5SvewRBDIOhT8Kvr56n9XN8j', 'tQDEQ7YXSe3VKPsJIIhiuNBm2rTEDgL7hcIxMA1pxJoCTQMIJZci5oNLkICmYpwyT7AFjqSxPS8c', 'nEme1xg0XjwMt931qDVMlHcmbVAF3AfP3vEEMnmwCPLAjtFfHWqEXAkDPfv7O4TqeMVHf7SYU6K9', 'UubGsrWmXp9Wbo35FHOgRy2tq6A6swsVT1gQG8kMZJntJ9xCNnUYacvDBSPJZo7HKhLAlz60TEam'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, ScbHcjkL7WWFyToAiCRaf56oKTSNfj51ak47Dj2qXVEu59Hst3poaCdYaMT.cs	Base64 encoded string: 'vyXwoJkwKvsIzP7BGaLnMN4sF818fDahmlRYMYbwvHYPaL0xY7b3BBG2JO9WSaB4y0aF0hxzTuA6', 'VFMlywpvMizqrVkcb7eSrij3TET1496k8eJsf0QqakJT8RPOSblDhhcJpU7n9qymF8qkjDQLbLHO', 'iM9Tn4I1zTKWORK66Y7qAfqeeic8p9pSiC8UFS1W7nlcnuadF1q97eq8mr5abdNVc1OrwThvvfhD'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	Base64 encoded string: 'Qia3JH5ymF4uaot3NOgNGEc2iJqN9Yz61iNWNXofusbPwKpWHLo652S9dPDQfxG97PWrtffubGbD', 'tvYpjF0Fhr1T7jvAXq1ftkzOAcIOVxZh80V69WF9xlcAFdBrIEON1yXC0eMGKdOAmekK0kvg1632'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	Base64 encoded string: 'rtxq5Rof5VoK1gUZBqQBCqYhJ5aIvZmIb2eGxnrlmOGOSvSmfQHBJL0EQd9R5ohd5NItSCijh1rv', 'x5RLU7OBqzlw1QybpIx5MhdSJNBz23u90nG367hmWm8BBqSe1g80LHWgl8NorbWtCqAx6q25XBrx', 'XUr0GkELP964gE0qbsFOecveuCGbaGPoSBqdaskJtLMd0qyYLa498rDBWJ5e5PYnBjJQYEYRl6HT', 'ZLxfcNUPqaZWJtIsJpxbiTIjhAriL5OcI9G5ycHNrMdU0nTZLrl2Dn3H5YSK7OyBxlgnHr5XTb9c', 'Le0FQcDbNUoDNQtOwagaZDMdywgQBY5WxGhuLBZLREnV1NQnJkcV74Z9kEj3vQbJpRfIhi0wt4uy', 'KgVv2gYZOCy9II0A0VYHeo2tvMef1X9YtlnmlpSN1TsMqcRVnUUo8k7eIuZOf20E22b27Eyb1VIS', 'ScRFWcLIiLeHtPcypfhWfvXhxfO7i9SslqIHtZ6kd74Nimh8X81Tq7cdNUVqbapzr2BmQ4p5XHmB', 'MpIf5hgk8GifrzO7jaRErduFRd4yvWxzCTcvErgMhnDkWmo6MziCxUHy2GcFtqfbte9rackeK72E', 'R7RyBRhJpKUJIvDaqEyNV12fLDoXfrahTFW0WdbAl76oh56QtWJIhXIPRfUt9rpp3L98wXepqJJx'
Source: FluxusV1.2.2.dr, lCnryOV9jmTEZuL5mPAIjPEDs3WY2hwiIPCV4RgbEJYqGbLYpIsXHsN095G.cs	Base64 encoded string: 'QiamGmoEX3zEaiB7jomxiUiYlXdBll5VNvZCONfJJZT7dzhp6icN2T0XBSCP6JZ32RnNjTrfhEGL', 'VEo6kE4Eu88feqz2TnuNxCe1Wt6pMJBPZBLiAs4Jit1Vl84oc2p7HE7ubS236xkqjKMPu8yXQ220', 'pFDHTv8dzmVT5cdhzPqeeKrTanQRN4jU2ZDKzDbflH73hUpwrH5m7ZenRTP3kBpSxj7xKORs3vb8', 'iJYJct2SVfOBjRpftkVpnvThpW1lrWn9wyDrevufVA5PSHEi8k1ZwLJcfwjh1AAIK97pyFr1qFbO', 'Gmw5GJMmljKoqMNZYZQByiOD688GiJ8kS47841pVbbXt2gOyrO9VBl303Fp6A2AHq6hOQVWfbo3I', 'NTKYezmNFmEoTmei08SYHSgPIA1WhICauFeY7tUmFPHg3uZEo25bCFsiqDEA8f5H3EsdPaM1Cfry', 'HgC1rTjd6Mygu5q4XdhcwwUf5o8CkqkoYdK4xAhQcNK0Xl5SkhBS5SvewRBDIOhT8Kvr56n9XN8j', 'tQDEQ7YXSe3VKPsJIIhiuNBm2rTEDgL7hcIxMA1pxJoCTQMIJZci5oNLkICmYpwyT7AFjqSxPS8c', 'nEme1xg0XjwMt931qDVMlHcmbVAF3AfP3vEEMnmwCPLAjtFfHWqEXAkDPfv7O4TqeMVHf7SYU6K9', 'UubGsrWmXp9Wbo35FHOgRy2tq6A6swsVT1gQG8kMZJntJ9xCNnUYacvDBSPJZo7HKhLAlz60TEam'
Source: FluxusV1.2.2.dr, ScbHcjkL7WWFyToAiCRaf56oKTSNfj51ak47Dj2qXVEu59Hst3poaCdYaMT.cs	Base64 encoded string: 'vyXwoJkwKvsIzP7BGaLnMN4sF818fDahmlRYMYbwvHYPaL0xY7b3BBG2JO9WSaB4y0aF0hxzTuA6', 'VFMlywpvMizqrVkcb7eSrij3TET1496k8eJsf0QqakJT8RPOSblDhhcJpU7n9qymF8qkjDQLbLHO', 'iM9Tn4I1zTKWORK66Y7qAfqeeic8p9pSiC8UFS1W7nlcnuadF1q97eq8mr5abdNVc1OrwThvvfhD'
Source: FluxusV1.2.2.dr, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	Base64 encoded string: 'Qia3JH5ymF4uaot3NOgNGEc2iJqN9Yz61iNWNXofusbPwKpWHLo652S9dPDQfxG97PWrtffubGbD', 'tvYpjF0Fhr1T7jvAXq1ftkzOAcIOVxZh80V69WF9xlcAFdBrIEON1yXC0eMGKdOAmekK0kvg1632'
Source: FluxusV1.2.2.dr, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	Base64 encoded string: 'rtxq5Rof5VoK1gUZBqQBCqYhJ5aIvZmIb2eGxnrlmOGOSvSmfQHBJL0EQd9R5ohd5NItSCijh1rv', 'x5RLU7OBqzlw1QybpIx5MhdSJNBz23u90nG367hmWm8BBqSe1g80LHWgl8NorbWtCqAx6q25XBrx', 'XUr0GkELP964gE0qbsFOecveuCGbaGPoSBqdaskJtLMd0qyYLa498rDBWJ5e5PYnBjJQYEYRl6HT', 'ZLxfcNUPqaZWJtIsJpxbiTIjhAriL5OcI9G5ycHNrMdU0nTZLrl2Dn3H5YSK7OyBxlgnHr5XTb9c', 'Le0FQcDbNUoDNQtOwagaZDMdywgQBY5WxGhuLBZLREnV1NQnJkcV74Z9kEj3vQbJpRfIhi0wt4uy', 'KgVv2gYZOCy9II0A0VYHeo2tvMef1X9YtlnmlpSN1TsMqcRVnUUo8k7eIuZOf20E22b27Eyb1VIS', 'ScRFWcLIiLeHtPcypfhWfvXhxfO7i9SslqIHtZ6kd74Nimh8X81Tq7cdNUVqbapzr2BmQ4p5XHmB', 'MpIf5hgk8GifrzO7jaRErduFRd4yvWxzCTcvErgMhnDkWmo6MziCxUHy2GcFtqfbte9rackeK72E', 'R7RyBRhJpKUJIvDaqEyNV12fLDoXfrahTFW0WdbAl76oh56QtWJIhXIPRfUt9rpp3L98wXepqJJx'

Source: FluxusV1.2.2.dr, nHofwfuZBubj5cDBdBG9TsTr2q.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: FluxusV1.2.2.dr, nHofwfuZBubj5cDBdBG9TsTr2q.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: MyNigga!.exe.0.dr, nHofwfuZBubj5cDBdBG9TsTr2q.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: MyNigga!.exe.0.dr, nHofwfuZBubj5cDBdBG9TsTr2q.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, nHofwfuZBubj5cDBdBG9TsTr2q.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, nHofwfuZBubj5cDBdBG9TsTr2q.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, nHofwfuZBubj5cDBdBG9TsTr2q.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, nHofwfuZBubj5cDBdBG9TsTr2q.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@23/19@6/5

Source: C:\Users\user\Desktop\oIDX88LpSs.exe

File created: C:\Users\user\AppData\Roaming\MyNigga!.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6412:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7084
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Mutant created: NULL
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6416:120:WilError_03
Source: C:\Windows\System32\SIHClient.exe	Mutant created: {376155FF-95A0-46CA-8F57-ACB09EA70153}
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Mutant created: \Sessions\1\BaseNamedObjects\pAAWfDfK5sHwddPw
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3796:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7108:120:WilError_03
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Mutant created: \Sessions\1\BaseNamedObjects\8FQwHxphgRGaYrfc5

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Source: oIDX88LpSs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: oIDX88LpSs.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\oIDX88LpSs.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\oIDX88LpSs.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: unknown	Process created: C:\Users\user\Desktop\oIDX88LpSs.exe "C:\Users\user\Desktop\oIDX88LpSs.exe"
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process created: C:\Users\user\AppData\Roaming\MyNigga!.exe "C:\Users\user\AppData\Roaming\MyNigga!.exe"
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process created: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe "C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe"
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FluxusV1" /tr "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7084 -s 2188
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process created: C:\Windows\System32\SIHClient.exe C:\Windows\System32\sihclient.exe /cv 7NrvztKWqECbt1RuJH7L+Q.0.2
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process created: C:\Users\user\AppData\Roaming\MyNigga!.exe "C:\Users\user\AppData\Roaming\MyNigga!.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process created: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe "C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FluxusV1" /tr "C:\Users\user\AppData\Roaming\FluxusV1.2"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior

Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll

Source: C:\Users\user\Desktop\oIDX88LpSs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: FluxusV1.lnk.2.dr

LNK file: ..\..\..\..\..\FluxusV1.2

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\oIDX88LpSs.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: oIDX88LpSs.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: oIDX88LpSs.exe

Static file information: File size 1073664 > 1048576

Source: oIDX88LpSs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Data.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.ni.pdbRSDS source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: .22.PDB source: BootstrapperV1.22.exe, 00000003.00000002.2254195072.000001BF53F2A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54334000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Data.ni.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.pdb source: BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54334000.00000004.00000800.00020000.00000000.sdmp, WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Data.pdbH source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Numerics.ni.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdbH source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: mscorlib.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: mscorlib.ni.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Core.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Numerics.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.ni.pdb source: WERD84A.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERD84A.tmp.dmp.14.dr

Data Obfuscation

Source: MyNigga!.exe.0.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{cr1vYmUoWA827Qjk0a5UCxF4hG.h2EyfuBxvbF3nJfMe7lbGOt7Iq,cr1vYmUoWA827Qjk0a5UCxF4hG.tbOLBm1RDUA274a7uT509LzOUq,cr1vYmUoWA827Qjk0a5UCxF4hG.Abfkpa5Vi34VPtBiEJBmtBAapc,cr1vYmUoWA827Qjk0a5UCxF4hG._7dZ1VWnJ6edqILF8DCRTB2DbHv,HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.KSemhoXSH4yhV74mOzNyVc3Cazw99MPaUTWd4L5S9qg6u9fLOXjSqM7ltee()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: MyNigga!.exe.0.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{iCv3CGDzL780B8makpkFXmR8a1[2],HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.gj5U3XdNcGjgRwKAkGMsOakQjGP1eXOqwIoX3Xwrsejp0Dwu5nQ3kPyGmAx(Convert.FromBase64String(iCv3CGDzL780B8makpkFXmR8a1[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{cr1vYmUoWA827Qjk0a5UCxF4hG.h2EyfuBxvbF3nJfMe7lbGOt7Iq,cr1vYmUoWA827Qjk0a5UCxF4hG.tbOLBm1RDUA274a7uT509LzOUq,cr1vYmUoWA827Qjk0a5UCxF4hG.Abfkpa5Vi34VPtBiEJBmtBAapc,cr1vYmUoWA827Qjk0a5UCxF4hG._7dZ1VWnJ6edqILF8DCRTB2DbHv,HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.KSemhoXSH4yhV74mOzNyVc3Cazw99MPaUTWd4L5S9qg6u9fLOXjSqM7ltee()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{iCv3CGDzL780B8makpkFXmR8a1[2],HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.gj5U3XdNcGjgRwKAkGMsOakQjGP1eXOqwIoX3Xwrsejp0Dwu5nQ3kPyGmAx(Convert.FromBase64String(iCv3CGDzL780B8makpkFXmR8a1[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{cr1vYmUoWA827Qjk0a5UCxF4hG.h2EyfuBxvbF3nJfMe7lbGOt7Iq,cr1vYmUoWA827Qjk0a5UCxF4hG.tbOLBm1RDUA274a7uT509LzOUq,cr1vYmUoWA827Qjk0a5UCxF4hG.Abfkpa5Vi34VPtBiEJBmtBAapc,cr1vYmUoWA827Qjk0a5UCxF4hG._7dZ1VWnJ6edqILF8DCRTB2DbHv,HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.KSemhoXSH4yhV74mOzNyVc3Cazw99MPaUTWd4L5S9qg6u9fLOXjSqM7ltee()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{iCv3CGDzL780B8makpkFXmR8a1[2],HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.gj5U3XdNcGjgRwKAkGMsOakQjGP1eXOqwIoX3Xwrsejp0Dwu5nQ3kPyGmAx(Convert.FromBase64String(iCv3CGDzL780B8makpkFXmR8a1[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: FluxusV1.2.2.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{cr1vYmUoWA827Qjk0a5UCxF4hG.h2EyfuBxvbF3nJfMe7lbGOt7Iq,cr1vYmUoWA827Qjk0a5UCxF4hG.tbOLBm1RDUA274a7uT509LzOUq,cr1vYmUoWA827Qjk0a5UCxF4hG.Abfkpa5Vi34VPtBiEJBmtBAapc,cr1vYmUoWA827Qjk0a5UCxF4hG._7dZ1VWnJ6edqILF8DCRTB2DbHv,HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.KSemhoXSH4yhV74mOzNyVc3Cazw99MPaUTWd4L5S9qg6u9fLOXjSqM7ltee()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: FluxusV1.2.2.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{iCv3CGDzL780B8makpkFXmR8a1[2],HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.gj5U3XdNcGjgRwKAkGMsOakQjGP1eXOqwIoX3Xwrsejp0Dwu5nQ3kPyGmAx(Convert.FromBase64String(iCv3CGDzL780B8makpkFXmR8a1[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: MyNigga!.exe.0.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: EaEpGw36JMEDJRe3miGBPyMlQ6 System.AppDomain.Load(byte[])
Source: MyNigga!.exe.0.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: XzRAbwMylpftVFxC6ZlSX8x4NH System.AppDomain.Load(byte[])
Source: MyNigga!.exe.0.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: XzRAbwMylpftVFxC6ZlSX8x4NH
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: EaEpGw36JMEDJRe3miGBPyMlQ6 System.AppDomain.Load(byte[])
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: XzRAbwMylpftVFxC6ZlSX8x4NH System.AppDomain.Load(byte[])
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: XzRAbwMylpftVFxC6ZlSX8x4NH
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: EaEpGw36JMEDJRe3miGBPyMlQ6 System.AppDomain.Load(byte[])
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: XzRAbwMylpftVFxC6ZlSX8x4NH System.AppDomain.Load(byte[])
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: XzRAbwMylpftVFxC6ZlSX8x4NH
Source: FluxusV1.2.2.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: EaEpGw36JMEDJRe3miGBPyMlQ6 System.AppDomain.Load(byte[])
Source: FluxusV1.2.2.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: XzRAbwMylpftVFxC6ZlSX8x4NH System.AppDomain.Load(byte[])
Source: FluxusV1.2.2.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	.Net Code: XzRAbwMylpftVFxC6ZlSX8x4NH

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Code function: 2_2_00007FFD346F24AD push E95D543Bh; retf	2_2_00007FFD346F2589
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Code function: 2_2_00007FFD346F243D push E95D543Bh; retf	2_2_00007FFD346F2589
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346FD668 push ss; retf	3_2_00007FFD346FD837
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346E00BD pushad ; iretd	3_2_00007FFD346E00C1
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346E7A48 push ebx; retf 5F4Dh	3_2_00007FFD346E7A6A
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Code function: 3_2_00007FFD346FA272 push ebx; retf	3_2_00007FFD346FA282

Source: oIDX88LpSs.exe

Static PE information: section name: .text entropy: 7.997455883815368

Source: oIDX88LpSs.exe, 6erNU9GoRtGQsFcnnrGTGgBTl1yaTwHR6rinJwi9plL4REYW5dMRtyPsdevOJ0m8ncPWxIZGM.cs	High entropy of concatenated method names: 'l32tkBUxwdBvpyeMmPt16Hxp0SRF2LAPlhVLDNV4169SB40qxYvBngUsTVlFCEvXdQnNpQHml', 'JGtIU3ZIYHZ0wFvRwlkyOqk5L8yHlA1sxxsJKLKHaorUw9hknPBOCqH6a2FgCJMUwABlcKbsP', 'DBpBxuFaSFuyVHuOct6O4u4OfeIwkeP0FZPiKNn6v4oubvJIgg9NHx4Yqkp5pv3AKU8mrsScz', 'K7w1uTrw6eTVhaTlepN7YygebnUaIB48c8ud2DJQE7eiACUGH1eOZjJ5nF2slILwZ4LioKs5D', 'SckIXPFLtwrar7KEyyMsGhrgwG2n56kZfOreWcSOuaVvRqWwbLjS2htKu97', 'iw1tk4bKOUTQyTjCoZyu9QICbbPVHFWZKzMjeDP1OMXZ51Fu3xbowbnLQZA', 'gIMOjaQ8PzdIURhXo5wrgJorVUuFFgOZWzDknVbMBxHx7MLJ4xgdGxaHFgF', 'jtGvKAwXsUIrmY8rc2HNJxUm11fNLIpIAwbY87R9HwDfY00xBz2MU8XTT8V', 'xTT3JHA6UQ6wTvLlDPWi9oBcy3YobXnr45H3NA5B7UYrXKZCidyCCCXHTUf', 'jrbHkxUvZ1eZa9DBPt9aphAZEKUW1o2FOzR3GJRiUFWaAeQzwhlqcW72K92'
Source: oIDX88LpSs.exe, hO0FzIpqPd4LkEhD4ZWJHKuBnEiqP0DkpVRCcU38YDcWVuWBovCPBjCgSYJpSzXUSIitBZCcX.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'XOVH1muPBJVdAlqt0EL5HHasW8dTvAMMxC1AsDep7dntMM65K0yQDW0Ah86', 'FDnvZwKoLcuyHnAWOBhiCeEvVmlv5sBNOUEFq3P7VcdObL1LK8vBdWvLsiw', 'OmupEak8B1NuZkoiVgdyiISYRXxlgJqgxE9KN64XZBTVB4sv89nZaVS4Dc3', 'CwePezRj3Fr5FOl7W66UbmJXbm5D8q0IxAuvbv5SLoM2BrBpINTho1v05mJ'
Source: MyNigga!.exe.0.dr, cr1vYmUoWA827Qjk0a5UCxF4hG.cs	High entropy of concatenated method names: 'fyeU9AxGw5jCo6jhbn515DtDEYSuvGVtGjrJNEygS1cI', 'lZnzwd18ce11dsW9ceza9J8PTkbeDqbFQdoK1tWMJ95r', 'Pb6spKLQM3VRgaDFQqlGCboObEwJmgBgxGrv9E3RlQIA', '_8xIZnDb1zQvtUYwJzIWChfrF5PNclkrKPzDl01rOSNO4'
Source: MyNigga!.exe.0.dr, m6Na4dP1oFMCkrcGGL0mqHQAAxOZ4jViwW8utTuGlHXwf62yG1i0e2LFBQ2.cs	High entropy of concatenated method names: '_1qQobQwfC3BZXFDgN45Zn0ZYqIZprjyyq7706XNPOxNiO06hqMVKbcYSesp', 'y252ODASucLxXtvJ68oq9mO8ipsyu0gua3SX4aJ0sokz2Lnw1aX55BG22UG', 'ELfZolPZ2Vy4UvXGWBYdie1X1L9sHt8mo9kdAf6Nxw1Nb9QmX9E66k00RUY', 'fzbV5PMeXg1VrOJXWNVEhbkHrUJezta0OguOmXSuxX7mUhmOiV8kZ0ZVc0XwX', '_5gvOUWTiSLfq7qJnFrYGNUgTEk4XpFeH4CZyZ60nfmO20xB7xcdtM7bFmG2CZ', 'm3eFmIvFIXaxe8tCdghiUoU22ein7MMADurE32eJ0XJXpfMS7ywdOOuXWKfgK', 'srcnxNTxzwcRfPtGIGidl1IW6DNbRitHzzgc1G44N4kiRjk1YnTFkfBp2Urn4', 'YYK8vfshyxHShm9AM1V4WAVQsrDrAMpRUNuCvMdTj82EPataOlt49wgBCkOf2', '_9KdBJRlch3CLwTwTEWsKFIYAQOnp9vGvhcMMfnSVHXUEk0IkfAwSd6D9Rfrda', 'lV4pVDpoiT7WZAiJC0Uw96ZNqaeEvEUE7noLft3e8Z2tweQDFVSeH97URfu2M'
Source: MyNigga!.exe.0.dr, KGc4FHS1KfPCQB4LKxld1jofGn.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'qvs8VBnRNGpFIQObRaB37OCc3i4LHMlIkedPlCLMW3Bj', 'vxIgN4MaGCavv2RGOjH36h7OJEZIMzgudCZpoPA3X760', 'kpsehZOJHa1OS5h1KNJiqdHQHF4fVE2HMNWbFE7eqh8I', 'dSqxYOCUwGEgQ1bVkvQvxCIPPt9htUlKMMaIePEmC0qH'
Source: MyNigga!.exe.0.dr, lCnryOV9jmTEZuL5mPAIjPEDs3WY2hwiIPCV4RgbEJYqGbLYpIsXHsN095G.cs	High entropy of concatenated method names: 'qTRMJJbumLlaKev5QX0PV0hROeKGb3DJVF7a3majgWToLUk5TrSkLL0JEtP', 'r8L96OTFMvsSSdLtu1Hv98dUfpXlPzpwHEuVxU2aTa8mJEN8E6r35myPiVA', 'TtcUBTiC0xNxrhNCQIB4qjYDpsxRoqICmy5apHSSoHbcxZRVI5zBZ4Uh8gN', 'YBxK7HTqW1ESxjFBLSGljIVdHoxHOBhL7hvmtLGFLLX5azSwoN0LbaA05vK', 'PnHYLwhB6MB9T4DxaC8tdHLk9zNfGRtjL55WkqHzZUXILttCOvkn5ATvvnD', 'JRNIox8Z3mIWfI5xLc60vUzqMhRGyUxTEMuZO24LNsliT59EurCiHkGkbIf', 'ON23Fyf59PVN7p5cQMRiWnKaPU3qRpnAEB5vOhMuR8LoiIzwcIcd5KQw48N', '_00KHclEscPHcys9KLQR5wcNGTb3bLAzeHLmtBBfmSoiOLcoxDMMgxfSLtHm', 'w84S9yc9nOPEtADdaVsaEbEEgh5XSM2SRw00Mi7sI8uyXV89vGS6oGMbM1r', 'aNsO9yBlGo7N2uUAchUSku4R2Iox9ccOzxiHCUWEJYqjM6f9Ob55Wxjzlv2'
Source: MyNigga!.exe.0.dr, ScbHcjkL7WWFyToAiCRaf56oKTSNfj51ak47Dj2qXVEu59Hst3poaCdYaMT.cs	High entropy of concatenated method names: 'Mulp7zUdSK9VYu5IZad0FEyupQP3isuHGuCDcRQiJxQulOK7Shg8pyUUvDs', '_2HbNt4XG8rI1HKjVNZbw1CoZL9wG2S51sZ1RlKIGL7bNB2KRlbaH4B7a19e', 'QJwP9Y6enPgjLwCNywUy9XkmgxTzio2U7LNVWWemEJO1ePc4Z4ty97iqyYk', '_4HrhtnYpd4KfQFHb7AKYeWI2XBKCYfJL8c7KJPULMDVGvILyeCmS22hSYn3', 'my9E6khIp6RoQtLVaDTPqpQLwDdav3H2cBLkiBF1BE5LZ8d6sn0iSURQwEkAOJQqZvjFvVtqxTt3', 'WufbtFzfM6Ou4aWjTbtTipr2k49m6ZIJ7ZYNL6aAcqqhWtL4uqYEoUuKsWjhrc4n4ITxSDc44OXm', 'RPyLLpBR90uUAPzFKM827jCidpbJKPT9d76Stx2nRsTEnUC8gKQSRb36PEtAqvMjsBtm6mTjTLOJ', 'x0xfMhqQwO6D0RvIFww9Dr8JxC1P8GDaUa9yKCnJ94MwLAj0psBoxPeVZ4z1lAdPIbXraI0jfvZK', '_77MFPIL8sXPNGzf6Vr2YyHh3ehiJT5w0BArWTcJPf0QSzVIHxkTkcJiScL08x5ydF63gS3Ll2h2x', 'Ifg7sxQUD18K2UHgPtFeucjteYcrBFjGw8A74f4muNVKjMRPAE4nCnvqf1NHZGdgndhjWmq3vAgW'
Source: MyNigga!.exe.0.dr, nHofwfuZBubj5cDBdBG9TsTr2q.cs	High entropy of concatenated method names: 'ELfyIN64gvVpp7SykRVCihrPTD', 'pMJF5MgINI7jrPo1fAXiAJxfka', 'asLMMEqw8jqY4eXTtvhzYVQYNv', 'Wef4FOQRyo9tAx2wxYoVlYMwN6', '_6JUBihuDcb8vOst8qjHwf7UuB5', '_41igpNgCm5vGX9Yci4E8MYp5dk', 'vGfPmAZ0dF66GLz06UtvBsjIaT', 'ZlU4hm4qAQcRXb0MrpfD2woqcp', '_9GoGqF8cvVV0RAzR529nkF3XvG', 'PxUqAsdiTIOl41dZFxuXn6vxSn'
Source: MyNigga!.exe.0.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	High entropy of concatenated method names: 'e0eTGJjyteWiHuiyFlwbHW4il0', 'EaEpGw36JMEDJRe3miGBPyMlQ6', 'Aleca4La6EV6C5NWVU8gOZgFRo', 'fgcpLIuTLJ3cU8m37DSBp2vasD', 'xOcfv2pwntCi1mfdOBrZY1BdWS', 'Vl2B24fjdLNgdms6tDas54hBha', 'qsh0GOvE9SVMQCEVL4xpJkQZYO', 'Ikhg0ZKkwT1KaSzqPN7p7g8Hm7', 'GLyOtTQHVPQqJiLuiWs3Lk9ths', 'Z8UuTBtMQNVYsuD3h6DUxI25XY'
Source: MyNigga!.exe.0.dr, 1IzZeZTCJbjXCt7H00DOEXEv14.cs	High entropy of concatenated method names: 'FGNIsJmOykr3ePLIvfghdl82rE', 'iFMfNJ8tX7tyyJsVz54nOofmpWqm0UlCHP3Jh2daFxqJ', '_1Aaw4RFWjQVydm3WDNOfGFQjzh3P1B9ILUhqqx2ONVsy', '_4O6xqRfIIC7p2Jv3RL7qNzv5stbSYR9gxRjf6bmaYJzL', 'jQZZVEYz1wKZmlKz32FwUYq8ccFSMpoVymeH0OH4k4ED'
Source: MyNigga!.exe.0.dr, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	High entropy of concatenated method names: 'X62lMf9Fo642ghnpIdH4ryrmWJnk5ojYqcmADta3uxk0WAPMDYottPU2RRE', 'KUJQI2n84phxAWGmHRptJafl2pMbccyfgxCQZWNRzf66ShXdIqnxVf2h9dDXTVqr5J3iM9PQHwr5', 'Blr9tkCYi6BWhPs187jQjtqCes5OTtVjdUIeIC7lmiu8GduDNlPK4ZljZFFQdgrXuXFGKY6x8o1a', 'GQSx9Q50t9YTZplZikXb96OzLV4cbvIcAzqPKYIkAIEQykjMhb1ITIVhkapVudX6GGkzGAu0jlzj', '_0elCUiPfUSuvWL1HLrc9OQRnDOlqPdJLNxIs9Q0sSNmyctfNqVqONUzkFFoPNaTry9gOdWzVPSEW'
Source: MyNigga!.exe.0.dr, PJALqz39sBtzbnxazUO1cDrRHY.cs	High entropy of concatenated method names: 'mOybXieFxgzFW9F6hFxCu3WTGx', 'eMjHERXKLY7qr9i73mFZgBF8qw', 'pETlcwsuCpoxf73iWgLO3Vxi24', 'MJCQR8d3ayRI2BknSp97GUcAat', 'LSRD3vXFbk1IZ9Ju2x5mznqT3AzXLifIiiJY4smGb6D3', 'quD5R0BocQVtcgV9g4yiaN3I5qCsayPqqKNoCcWuTUm3', '_2F3jHAgxZJ4g5gPpchtfPtG1dIdS8N4IplRobGtY3ArG', 'ZdciAm8ylkTO2AXVEI4eyxDZGtJSoyTNcqD1xV1a0vMD', 'tkOHTlPXRBlnLb9dk8FEZHFe6W11yoxsvsyk7sfLhcoN', 'jXVDi6SCnWW8SZ4o46fiDxbcKJgSkGyRe8yK1aPg9qCs'
Source: MyNigga!.exe.0.dr, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	High entropy of concatenated method names: 'zz4vBEJbcvwEgGIfmyiut7LrTym3AwtZaTO8JPs7Cc0qFC4HFZ8h49XQUYp', 'UpinnvOruu3DYsOtM7Ik2ELmQz8Ts541mkivta8krXFIUgcvcsDGQi2vNF4', 'WTULDY12DGY3j4RFDHX994Eivlm3gZOo1H50X0aKgnOuKneKosIo3kY8gK5', '_6WR5WhtUNv8vTNugYC68XiqnVNBPQmS5LEHvLHZwZCGHOCMcgPXmNi7XBp1', 'QF6HQhTmfq2t8qh2yKNNy9wgbHt0dTygSjOFmDsPkk11kiZo9HdTNiOP94j', 'K27vHG2YSCvX4IIxlbra0T5qGa5BtyeMoHBMTyMP8TiIYmDUutBTLtAG0n5', 's1RRxCzJyYPsGP2jiTgVKYVW0FYSQSHijzWiQvDU0zRIeDqLWKiZb3QaB0w', 'e2bkoiRpeIASLoQQVIj6ug9f0RIlMqP8FKTbX7IBIi9s37bQcKDGX4mXxF2', 'Y0xP6o7CgV1RDr8A1FMwgYGnhMNfqqw5nFagABz0gBKVIXFCFlJppxnOzdh', 'yHRh8Azo2Diqe4d7KWv4JXD4EFYVegvE0yFh6IhoJtiPPOyrlyBo5daU0KB'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, cr1vYmUoWA827Qjk0a5UCxF4hG.cs	High entropy of concatenated method names: 'fyeU9AxGw5jCo6jhbn515DtDEYSuvGVtGjrJNEygS1cI', 'lZnzwd18ce11dsW9ceza9J8PTkbeDqbFQdoK1tWMJ95r', 'Pb6spKLQM3VRgaDFQqlGCboObEwJmgBgxGrv9E3RlQIA', '_8xIZnDb1zQvtUYwJzIWChfrF5PNclkrKPzDl01rOSNO4'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, m6Na4dP1oFMCkrcGGL0mqHQAAxOZ4jViwW8utTuGlHXwf62yG1i0e2LFBQ2.cs	High entropy of concatenated method names: '_1qQobQwfC3BZXFDgN45Zn0ZYqIZprjyyq7706XNPOxNiO06hqMVKbcYSesp', 'y252ODASucLxXtvJ68oq9mO8ipsyu0gua3SX4aJ0sokz2Lnw1aX55BG22UG', 'ELfZolPZ2Vy4UvXGWBYdie1X1L9sHt8mo9kdAf6Nxw1Nb9QmX9E66k00RUY', 'fzbV5PMeXg1VrOJXWNVEhbkHrUJezta0OguOmXSuxX7mUhmOiV8kZ0ZVc0XwX', '_5gvOUWTiSLfq7qJnFrYGNUgTEk4XpFeH4CZyZ60nfmO20xB7xcdtM7bFmG2CZ', 'm3eFmIvFIXaxe8tCdghiUoU22ein7MMADurE32eJ0XJXpfMS7ywdOOuXWKfgK', 'srcnxNTxzwcRfPtGIGidl1IW6DNbRitHzzgc1G44N4kiRjk1YnTFkfBp2Urn4', 'YYK8vfshyxHShm9AM1V4WAVQsrDrAMpRUNuCvMdTj82EPataOlt49wgBCkOf2', '_9KdBJRlch3CLwTwTEWsKFIYAQOnp9vGvhcMMfnSVHXUEk0IkfAwSd6D9Rfrda', 'lV4pVDpoiT7WZAiJC0Uw96ZNqaeEvEUE7noLft3e8Z2tweQDFVSeH97URfu2M'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, KGc4FHS1KfPCQB4LKxld1jofGn.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'qvs8VBnRNGpFIQObRaB37OCc3i4LHMlIkedPlCLMW3Bj', 'vxIgN4MaGCavv2RGOjH36h7OJEZIMzgudCZpoPA3X760', 'kpsehZOJHa1OS5h1KNJiqdHQHF4fVE2HMNWbFE7eqh8I', 'dSqxYOCUwGEgQ1bVkvQvxCIPPt9htUlKMMaIePEmC0qH'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, lCnryOV9jmTEZuL5mPAIjPEDs3WY2hwiIPCV4RgbEJYqGbLYpIsXHsN095G.cs	High entropy of concatenated method names: 'qTRMJJbumLlaKev5QX0PV0hROeKGb3DJVF7a3majgWToLUk5TrSkLL0JEtP', 'r8L96OTFMvsSSdLtu1Hv98dUfpXlPzpwHEuVxU2aTa8mJEN8E6r35myPiVA', 'TtcUBTiC0xNxrhNCQIB4qjYDpsxRoqICmy5apHSSoHbcxZRVI5zBZ4Uh8gN', 'YBxK7HTqW1ESxjFBLSGljIVdHoxHOBhL7hvmtLGFLLX5azSwoN0LbaA05vK', 'PnHYLwhB6MB9T4DxaC8tdHLk9zNfGRtjL55WkqHzZUXILttCOvkn5ATvvnD', 'JRNIox8Z3mIWfI5xLc60vUzqMhRGyUxTEMuZO24LNsliT59EurCiHkGkbIf', 'ON23Fyf59PVN7p5cQMRiWnKaPU3qRpnAEB5vOhMuR8LoiIzwcIcd5KQw48N', '_00KHclEscPHcys9KLQR5wcNGTb3bLAzeHLmtBBfmSoiOLcoxDMMgxfSLtHm', 'w84S9yc9nOPEtADdaVsaEbEEgh5XSM2SRw00Mi7sI8uyXV89vGS6oGMbM1r', 'aNsO9yBlGo7N2uUAchUSku4R2Iox9ccOzxiHCUWEJYqjM6f9Ob55Wxjzlv2'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, ScbHcjkL7WWFyToAiCRaf56oKTSNfj51ak47Dj2qXVEu59Hst3poaCdYaMT.cs	High entropy of concatenated method names: 'Mulp7zUdSK9VYu5IZad0FEyupQP3isuHGuCDcRQiJxQulOK7Shg8pyUUvDs', '_2HbNt4XG8rI1HKjVNZbw1CoZL9wG2S51sZ1RlKIGL7bNB2KRlbaH4B7a19e', 'QJwP9Y6enPgjLwCNywUy9XkmgxTzio2U7LNVWWemEJO1ePc4Z4ty97iqyYk', '_4HrhtnYpd4KfQFHb7AKYeWI2XBKCYfJL8c7KJPULMDVGvILyeCmS22hSYn3', 'my9E6khIp6RoQtLVaDTPqpQLwDdav3H2cBLkiBF1BE5LZ8d6sn0iSURQwEkAOJQqZvjFvVtqxTt3', 'WufbtFzfM6Ou4aWjTbtTipr2k49m6ZIJ7ZYNL6aAcqqhWtL4uqYEoUuKsWjhrc4n4ITxSDc44OXm', 'RPyLLpBR90uUAPzFKM827jCidpbJKPT9d76Stx2nRsTEnUC8gKQSRb36PEtAqvMjsBtm6mTjTLOJ', 'x0xfMhqQwO6D0RvIFww9Dr8JxC1P8GDaUa9yKCnJ94MwLAj0psBoxPeVZ4z1lAdPIbXraI0jfvZK', '_77MFPIL8sXPNGzf6Vr2YyHh3ehiJT5w0BArWTcJPf0QSzVIHxkTkcJiScL08x5ydF63gS3Ll2h2x', 'Ifg7sxQUD18K2UHgPtFeucjteYcrBFjGw8A74f4muNVKjMRPAE4nCnvqf1NHZGdgndhjWmq3vAgW'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, nHofwfuZBubj5cDBdBG9TsTr2q.cs	High entropy of concatenated method names: 'ELfyIN64gvVpp7SykRVCihrPTD', 'pMJF5MgINI7jrPo1fAXiAJxfka', 'asLMMEqw8jqY4eXTtvhzYVQYNv', 'Wef4FOQRyo9tAx2wxYoVlYMwN6', '_6JUBihuDcb8vOst8qjHwf7UuB5', '_41igpNgCm5vGX9Yci4E8MYp5dk', 'vGfPmAZ0dF66GLz06UtvBsjIaT', 'ZlU4hm4qAQcRXb0MrpfD2woqcp', '_9GoGqF8cvVV0RAzR529nkF3XvG', 'PxUqAsdiTIOl41dZFxuXn6vxSn'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	High entropy of concatenated method names: 'e0eTGJjyteWiHuiyFlwbHW4il0', 'EaEpGw36JMEDJRe3miGBPyMlQ6', 'Aleca4La6EV6C5NWVU8gOZgFRo', 'fgcpLIuTLJ3cU8m37DSBp2vasD', 'xOcfv2pwntCi1mfdOBrZY1BdWS', 'Vl2B24fjdLNgdms6tDas54hBha', 'qsh0GOvE9SVMQCEVL4xpJkQZYO', 'Ikhg0ZKkwT1KaSzqPN7p7g8Hm7', 'GLyOtTQHVPQqJiLuiWs3Lk9ths', 'Z8UuTBtMQNVYsuD3h6DUxI25XY'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, 1IzZeZTCJbjXCt7H00DOEXEv14.cs	High entropy of concatenated method names: 'FGNIsJmOykr3ePLIvfghdl82rE', 'iFMfNJ8tX7tyyJsVz54nOofmpWqm0UlCHP3Jh2daFxqJ', '_1Aaw4RFWjQVydm3WDNOfGFQjzh3P1B9ILUhqqx2ONVsy', '_4O6xqRfIIC7p2Jv3RL7qNzv5stbSYR9gxRjf6bmaYJzL', 'jQZZVEYz1wKZmlKz32FwUYq8ccFSMpoVymeH0OH4k4ED'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	High entropy of concatenated method names: 'X62lMf9Fo642ghnpIdH4ryrmWJnk5ojYqcmADta3uxk0WAPMDYottPU2RRE', 'KUJQI2n84phxAWGmHRptJafl2pMbccyfgxCQZWNRzf66ShXdIqnxVf2h9dDXTVqr5J3iM9PQHwr5', 'Blr9tkCYi6BWhPs187jQjtqCes5OTtVjdUIeIC7lmiu8GduDNlPK4ZljZFFQdgrXuXFGKY6x8o1a', 'GQSx9Q50t9YTZplZikXb96OzLV4cbvIcAzqPKYIkAIEQykjMhb1ITIVhkapVudX6GGkzGAu0jlzj', '_0elCUiPfUSuvWL1HLrc9OQRnDOlqPdJLNxIs9Q0sSNmyctfNqVqONUzkFFoPNaTry9gOdWzVPSEW'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, PJALqz39sBtzbnxazUO1cDrRHY.cs	High entropy of concatenated method names: 'mOybXieFxgzFW9F6hFxCu3WTGx', 'eMjHERXKLY7qr9i73mFZgBF8qw', 'pETlcwsuCpoxf73iWgLO3Vxi24', 'MJCQR8d3ayRI2BknSp97GUcAat', 'LSRD3vXFbk1IZ9Ju2x5mznqT3AzXLifIiiJY4smGb6D3', 'quD5R0BocQVtcgV9g4yiaN3I5qCsayPqqKNoCcWuTUm3', '_2F3jHAgxZJ4g5gPpchtfPtG1dIdS8N4IplRobGtY3ArG', 'ZdciAm8ylkTO2AXVEI4eyxDZGtJSoyTNcqD1xV1a0vMD', 'tkOHTlPXRBlnLb9dk8FEZHFe6W11yoxsvsyk7sfLhcoN', 'jXVDi6SCnWW8SZ4o46fiDxbcKJgSkGyRe8yK1aPg9qCs'
Source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	High entropy of concatenated method names: 'zz4vBEJbcvwEgGIfmyiut7LrTym3AwtZaTO8JPs7Cc0qFC4HFZ8h49XQUYp', 'UpinnvOruu3DYsOtM7Ik2ELmQz8Ts541mkivta8krXFIUgcvcsDGQi2vNF4', 'WTULDY12DGY3j4RFDHX994Eivlm3gZOo1H50X0aKgnOuKneKosIo3kY8gK5', '_6WR5WhtUNv8vTNugYC68XiqnVNBPQmS5LEHvLHZwZCGHOCMcgPXmNi7XBp1', 'QF6HQhTmfq2t8qh2yKNNy9wgbHt0dTygSjOFmDsPkk11kiZo9HdTNiOP94j', 'K27vHG2YSCvX4IIxlbra0T5qGa5BtyeMoHBMTyMP8TiIYmDUutBTLtAG0n5', 's1RRxCzJyYPsGP2jiTgVKYVW0FYSQSHijzWiQvDU0zRIeDqLWKiZb3QaB0w', 'e2bkoiRpeIASLoQQVIj6ug9f0RIlMqP8FKTbX7IBIi9s37bQcKDGX4mXxF2', 'Y0xP6o7CgV1RDr8A1FMwgYGnhMNfqqw5nFagABz0gBKVIXFCFlJppxnOzdh', 'yHRh8Azo2Diqe4d7KWv4JXD4EFYVegvE0yFh6IhoJtiPPOyrlyBo5daU0KB'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, cr1vYmUoWA827Qjk0a5UCxF4hG.cs	High entropy of concatenated method names: 'fyeU9AxGw5jCo6jhbn515DtDEYSuvGVtGjrJNEygS1cI', 'lZnzwd18ce11dsW9ceza9J8PTkbeDqbFQdoK1tWMJ95r', 'Pb6spKLQM3VRgaDFQqlGCboObEwJmgBgxGrv9E3RlQIA', '_8xIZnDb1zQvtUYwJzIWChfrF5PNclkrKPzDl01rOSNO4'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, m6Na4dP1oFMCkrcGGL0mqHQAAxOZ4jViwW8utTuGlHXwf62yG1i0e2LFBQ2.cs	High entropy of concatenated method names: '_1qQobQwfC3BZXFDgN45Zn0ZYqIZprjyyq7706XNPOxNiO06hqMVKbcYSesp', 'y252ODASucLxXtvJ68oq9mO8ipsyu0gua3SX4aJ0sokz2Lnw1aX55BG22UG', 'ELfZolPZ2Vy4UvXGWBYdie1X1L9sHt8mo9kdAf6Nxw1Nb9QmX9E66k00RUY', 'fzbV5PMeXg1VrOJXWNVEhbkHrUJezta0OguOmXSuxX7mUhmOiV8kZ0ZVc0XwX', '_5gvOUWTiSLfq7qJnFrYGNUgTEk4XpFeH4CZyZ60nfmO20xB7xcdtM7bFmG2CZ', 'm3eFmIvFIXaxe8tCdghiUoU22ein7MMADurE32eJ0XJXpfMS7ywdOOuXWKfgK', 'srcnxNTxzwcRfPtGIGidl1IW6DNbRitHzzgc1G44N4kiRjk1YnTFkfBp2Urn4', 'YYK8vfshyxHShm9AM1V4WAVQsrDrAMpRUNuCvMdTj82EPataOlt49wgBCkOf2', '_9KdBJRlch3CLwTwTEWsKFIYAQOnp9vGvhcMMfnSVHXUEk0IkfAwSd6D9Rfrda', 'lV4pVDpoiT7WZAiJC0Uw96ZNqaeEvEUE7noLft3e8Z2tweQDFVSeH97URfu2M'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, KGc4FHS1KfPCQB4LKxld1jofGn.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'qvs8VBnRNGpFIQObRaB37OCc3i4LHMlIkedPlCLMW3Bj', 'vxIgN4MaGCavv2RGOjH36h7OJEZIMzgudCZpoPA3X760', 'kpsehZOJHa1OS5h1KNJiqdHQHF4fVE2HMNWbFE7eqh8I', 'dSqxYOCUwGEgQ1bVkvQvxCIPPt9htUlKMMaIePEmC0qH'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, lCnryOV9jmTEZuL5mPAIjPEDs3WY2hwiIPCV4RgbEJYqGbLYpIsXHsN095G.cs	High entropy of concatenated method names: 'qTRMJJbumLlaKev5QX0PV0hROeKGb3DJVF7a3majgWToLUk5TrSkLL0JEtP', 'r8L96OTFMvsSSdLtu1Hv98dUfpXlPzpwHEuVxU2aTa8mJEN8E6r35myPiVA', 'TtcUBTiC0xNxrhNCQIB4qjYDpsxRoqICmy5apHSSoHbcxZRVI5zBZ4Uh8gN', 'YBxK7HTqW1ESxjFBLSGljIVdHoxHOBhL7hvmtLGFLLX5azSwoN0LbaA05vK', 'PnHYLwhB6MB9T4DxaC8tdHLk9zNfGRtjL55WkqHzZUXILttCOvkn5ATvvnD', 'JRNIox8Z3mIWfI5xLc60vUzqMhRGyUxTEMuZO24LNsliT59EurCiHkGkbIf', 'ON23Fyf59PVN7p5cQMRiWnKaPU3qRpnAEB5vOhMuR8LoiIzwcIcd5KQw48N', '_00KHclEscPHcys9KLQR5wcNGTb3bLAzeHLmtBBfmSoiOLcoxDMMgxfSLtHm', 'w84S9yc9nOPEtADdaVsaEbEEgh5XSM2SRw00Mi7sI8uyXV89vGS6oGMbM1r', 'aNsO9yBlGo7N2uUAchUSku4R2Iox9ccOzxiHCUWEJYqjM6f9Ob55Wxjzlv2'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, ScbHcjkL7WWFyToAiCRaf56oKTSNfj51ak47Dj2qXVEu59Hst3poaCdYaMT.cs	High entropy of concatenated method names: 'Mulp7zUdSK9VYu5IZad0FEyupQP3isuHGuCDcRQiJxQulOK7Shg8pyUUvDs', '_2HbNt4XG8rI1HKjVNZbw1CoZL9wG2S51sZ1RlKIGL7bNB2KRlbaH4B7a19e', 'QJwP9Y6enPgjLwCNywUy9XkmgxTzio2U7LNVWWemEJO1ePc4Z4ty97iqyYk', '_4HrhtnYpd4KfQFHb7AKYeWI2XBKCYfJL8c7KJPULMDVGvILyeCmS22hSYn3', 'my9E6khIp6RoQtLVaDTPqpQLwDdav3H2cBLkiBF1BE5LZ8d6sn0iSURQwEkAOJQqZvjFvVtqxTt3', 'WufbtFzfM6Ou4aWjTbtTipr2k49m6ZIJ7ZYNL6aAcqqhWtL4uqYEoUuKsWjhrc4n4ITxSDc44OXm', 'RPyLLpBR90uUAPzFKM827jCidpbJKPT9d76Stx2nRsTEnUC8gKQSRb36PEtAqvMjsBtm6mTjTLOJ', 'x0xfMhqQwO6D0RvIFww9Dr8JxC1P8GDaUa9yKCnJ94MwLAj0psBoxPeVZ4z1lAdPIbXraI0jfvZK', '_77MFPIL8sXPNGzf6Vr2YyHh3ehiJT5w0BArWTcJPf0QSzVIHxkTkcJiScL08x5ydF63gS3Ll2h2x', 'Ifg7sxQUD18K2UHgPtFeucjteYcrBFjGw8A74f4muNVKjMRPAE4nCnvqf1NHZGdgndhjWmq3vAgW'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, nHofwfuZBubj5cDBdBG9TsTr2q.cs	High entropy of concatenated method names: 'ELfyIN64gvVpp7SykRVCihrPTD', 'pMJF5MgINI7jrPo1fAXiAJxfka', 'asLMMEqw8jqY4eXTtvhzYVQYNv', 'Wef4FOQRyo9tAx2wxYoVlYMwN6', '_6JUBihuDcb8vOst8qjHwf7UuB5', '_41igpNgCm5vGX9Yci4E8MYp5dk', 'vGfPmAZ0dF66GLz06UtvBsjIaT', 'ZlU4hm4qAQcRXb0MrpfD2woqcp', '_9GoGqF8cvVV0RAzR529nkF3XvG', 'PxUqAsdiTIOl41dZFxuXn6vxSn'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	High entropy of concatenated method names: 'e0eTGJjyteWiHuiyFlwbHW4il0', 'EaEpGw36JMEDJRe3miGBPyMlQ6', 'Aleca4La6EV6C5NWVU8gOZgFRo', 'fgcpLIuTLJ3cU8m37DSBp2vasD', 'xOcfv2pwntCi1mfdOBrZY1BdWS', 'Vl2B24fjdLNgdms6tDas54hBha', 'qsh0GOvE9SVMQCEVL4xpJkQZYO', 'Ikhg0ZKkwT1KaSzqPN7p7g8Hm7', 'GLyOtTQHVPQqJiLuiWs3Lk9ths', 'Z8UuTBtMQNVYsuD3h6DUxI25XY'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, 1IzZeZTCJbjXCt7H00DOEXEv14.cs	High entropy of concatenated method names: 'FGNIsJmOykr3ePLIvfghdl82rE', 'iFMfNJ8tX7tyyJsVz54nOofmpWqm0UlCHP3Jh2daFxqJ', '_1Aaw4RFWjQVydm3WDNOfGFQjzh3P1B9ILUhqqx2ONVsy', '_4O6xqRfIIC7p2Jv3RL7qNzv5stbSYR9gxRjf6bmaYJzL', 'jQZZVEYz1wKZmlKz32FwUYq8ccFSMpoVymeH0OH4k4ED'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	High entropy of concatenated method names: 'X62lMf9Fo642ghnpIdH4ryrmWJnk5ojYqcmADta3uxk0WAPMDYottPU2RRE', 'KUJQI2n84phxAWGmHRptJafl2pMbccyfgxCQZWNRzf66ShXdIqnxVf2h9dDXTVqr5J3iM9PQHwr5', 'Blr9tkCYi6BWhPs187jQjtqCes5OTtVjdUIeIC7lmiu8GduDNlPK4ZljZFFQdgrXuXFGKY6x8o1a', 'GQSx9Q50t9YTZplZikXb96OzLV4cbvIcAzqPKYIkAIEQykjMhb1ITIVhkapVudX6GGkzGAu0jlzj', '_0elCUiPfUSuvWL1HLrc9OQRnDOlqPdJLNxIs9Q0sSNmyctfNqVqONUzkFFoPNaTry9gOdWzVPSEW'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, PJALqz39sBtzbnxazUO1cDrRHY.cs	High entropy of concatenated method names: 'mOybXieFxgzFW9F6hFxCu3WTGx', 'eMjHERXKLY7qr9i73mFZgBF8qw', 'pETlcwsuCpoxf73iWgLO3Vxi24', 'MJCQR8d3ayRI2BknSp97GUcAat', 'LSRD3vXFbk1IZ9Ju2x5mznqT3AzXLifIiiJY4smGb6D3', 'quD5R0BocQVtcgV9g4yiaN3I5qCsayPqqKNoCcWuTUm3', '_2F3jHAgxZJ4g5gPpchtfPtG1dIdS8N4IplRobGtY3ArG', 'ZdciAm8ylkTO2AXVEI4eyxDZGtJSoyTNcqD1xV1a0vMD', 'tkOHTlPXRBlnLb9dk8FEZHFe6W11yoxsvsyk7sfLhcoN', 'jXVDi6SCnWW8SZ4o46fiDxbcKJgSkGyRe8yK1aPg9qCs'
Source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	High entropy of concatenated method names: 'zz4vBEJbcvwEgGIfmyiut7LrTym3AwtZaTO8JPs7Cc0qFC4HFZ8h49XQUYp', 'UpinnvOruu3DYsOtM7Ik2ELmQz8Ts541mkivta8krXFIUgcvcsDGQi2vNF4', 'WTULDY12DGY3j4RFDHX994Eivlm3gZOo1H50X0aKgnOuKneKosIo3kY8gK5', '_6WR5WhtUNv8vTNugYC68XiqnVNBPQmS5LEHvLHZwZCGHOCMcgPXmNi7XBp1', 'QF6HQhTmfq2t8qh2yKNNy9wgbHt0dTygSjOFmDsPkk11kiZo9HdTNiOP94j', 'K27vHG2YSCvX4IIxlbra0T5qGa5BtyeMoHBMTyMP8TiIYmDUutBTLtAG0n5', 's1RRxCzJyYPsGP2jiTgVKYVW0FYSQSHijzWiQvDU0zRIeDqLWKiZb3QaB0w', 'e2bkoiRpeIASLoQQVIj6ug9f0RIlMqP8FKTbX7IBIi9s37bQcKDGX4mXxF2', 'Y0xP6o7CgV1RDr8A1FMwgYGnhMNfqqw5nFagABz0gBKVIXFCFlJppxnOzdh', 'yHRh8Azo2Diqe4d7KWv4JXD4EFYVegvE0yFh6IhoJtiPPOyrlyBo5daU0KB'
Source: FluxusV1.2.2.dr, cr1vYmUoWA827Qjk0a5UCxF4hG.cs	High entropy of concatenated method names: 'fyeU9AxGw5jCo6jhbn515DtDEYSuvGVtGjrJNEygS1cI', 'lZnzwd18ce11dsW9ceza9J8PTkbeDqbFQdoK1tWMJ95r', 'Pb6spKLQM3VRgaDFQqlGCboObEwJmgBgxGrv9E3RlQIA', '_8xIZnDb1zQvtUYwJzIWChfrF5PNclkrKPzDl01rOSNO4'
Source: FluxusV1.2.2.dr, m6Na4dP1oFMCkrcGGL0mqHQAAxOZ4jViwW8utTuGlHXwf62yG1i0e2LFBQ2.cs	High entropy of concatenated method names: '_1qQobQwfC3BZXFDgN45Zn0ZYqIZprjyyq7706XNPOxNiO06hqMVKbcYSesp', 'y252ODASucLxXtvJ68oq9mO8ipsyu0gua3SX4aJ0sokz2Lnw1aX55BG22UG', 'ELfZolPZ2Vy4UvXGWBYdie1X1L9sHt8mo9kdAf6Nxw1Nb9QmX9E66k00RUY', 'fzbV5PMeXg1VrOJXWNVEhbkHrUJezta0OguOmXSuxX7mUhmOiV8kZ0ZVc0XwX', '_5gvOUWTiSLfq7qJnFrYGNUgTEk4XpFeH4CZyZ60nfmO20xB7xcdtM7bFmG2CZ', 'm3eFmIvFIXaxe8tCdghiUoU22ein7MMADurE32eJ0XJXpfMS7ywdOOuXWKfgK', 'srcnxNTxzwcRfPtGIGidl1IW6DNbRitHzzgc1G44N4kiRjk1YnTFkfBp2Urn4', 'YYK8vfshyxHShm9AM1V4WAVQsrDrAMpRUNuCvMdTj82EPataOlt49wgBCkOf2', '_9KdBJRlch3CLwTwTEWsKFIYAQOnp9vGvhcMMfnSVHXUEk0IkfAwSd6D9Rfrda', 'lV4pVDpoiT7WZAiJC0Uw96ZNqaeEvEUE7noLft3e8Z2tweQDFVSeH97URfu2M'
Source: FluxusV1.2.2.dr, KGc4FHS1KfPCQB4LKxld1jofGn.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'qvs8VBnRNGpFIQObRaB37OCc3i4LHMlIkedPlCLMW3Bj', 'vxIgN4MaGCavv2RGOjH36h7OJEZIMzgudCZpoPA3X760', 'kpsehZOJHa1OS5h1KNJiqdHQHF4fVE2HMNWbFE7eqh8I', 'dSqxYOCUwGEgQ1bVkvQvxCIPPt9htUlKMMaIePEmC0qH'
Source: FluxusV1.2.2.dr, lCnryOV9jmTEZuL5mPAIjPEDs3WY2hwiIPCV4RgbEJYqGbLYpIsXHsN095G.cs	High entropy of concatenated method names: 'qTRMJJbumLlaKev5QX0PV0hROeKGb3DJVF7a3majgWToLUk5TrSkLL0JEtP', 'r8L96OTFMvsSSdLtu1Hv98dUfpXlPzpwHEuVxU2aTa8mJEN8E6r35myPiVA', 'TtcUBTiC0xNxrhNCQIB4qjYDpsxRoqICmy5apHSSoHbcxZRVI5zBZ4Uh8gN', 'YBxK7HTqW1ESxjFBLSGljIVdHoxHOBhL7hvmtLGFLLX5azSwoN0LbaA05vK', 'PnHYLwhB6MB9T4DxaC8tdHLk9zNfGRtjL55WkqHzZUXILttCOvkn5ATvvnD', 'JRNIox8Z3mIWfI5xLc60vUzqMhRGyUxTEMuZO24LNsliT59EurCiHkGkbIf', 'ON23Fyf59PVN7p5cQMRiWnKaPU3qRpnAEB5vOhMuR8LoiIzwcIcd5KQw48N', '_00KHclEscPHcys9KLQR5wcNGTb3bLAzeHLmtBBfmSoiOLcoxDMMgxfSLtHm', 'w84S9yc9nOPEtADdaVsaEbEEgh5XSM2SRw00Mi7sI8uyXV89vGS6oGMbM1r', 'aNsO9yBlGo7N2uUAchUSku4R2Iox9ccOzxiHCUWEJYqjM6f9Ob55Wxjzlv2'
Source: FluxusV1.2.2.dr, ScbHcjkL7WWFyToAiCRaf56oKTSNfj51ak47Dj2qXVEu59Hst3poaCdYaMT.cs	High entropy of concatenated method names: 'Mulp7zUdSK9VYu5IZad0FEyupQP3isuHGuCDcRQiJxQulOK7Shg8pyUUvDs', '_2HbNt4XG8rI1HKjVNZbw1CoZL9wG2S51sZ1RlKIGL7bNB2KRlbaH4B7a19e', 'QJwP9Y6enPgjLwCNywUy9XkmgxTzio2U7LNVWWemEJO1ePc4Z4ty97iqyYk', '_4HrhtnYpd4KfQFHb7AKYeWI2XBKCYfJL8c7KJPULMDVGvILyeCmS22hSYn3', 'my9E6khIp6RoQtLVaDTPqpQLwDdav3H2cBLkiBF1BE5LZ8d6sn0iSURQwEkAOJQqZvjFvVtqxTt3', 'WufbtFzfM6Ou4aWjTbtTipr2k49m6ZIJ7ZYNL6aAcqqhWtL4uqYEoUuKsWjhrc4n4ITxSDc44OXm', 'RPyLLpBR90uUAPzFKM827jCidpbJKPT9d76Stx2nRsTEnUC8gKQSRb36PEtAqvMjsBtm6mTjTLOJ', 'x0xfMhqQwO6D0RvIFww9Dr8JxC1P8GDaUa9yKCnJ94MwLAj0psBoxPeVZ4z1lAdPIbXraI0jfvZK', '_77MFPIL8sXPNGzf6Vr2YyHh3ehiJT5w0BArWTcJPf0QSzVIHxkTkcJiScL08x5ydF63gS3Ll2h2x', 'Ifg7sxQUD18K2UHgPtFeucjteYcrBFjGw8A74f4muNVKjMRPAE4nCnvqf1NHZGdgndhjWmq3vAgW'
Source: FluxusV1.2.2.dr, nHofwfuZBubj5cDBdBG9TsTr2q.cs	High entropy of concatenated method names: 'ELfyIN64gvVpp7SykRVCihrPTD', 'pMJF5MgINI7jrPo1fAXiAJxfka', 'asLMMEqw8jqY4eXTtvhzYVQYNv', 'Wef4FOQRyo9tAx2wxYoVlYMwN6', '_6JUBihuDcb8vOst8qjHwf7UuB5', '_41igpNgCm5vGX9Yci4E8MYp5dk', 'vGfPmAZ0dF66GLz06UtvBsjIaT', 'ZlU4hm4qAQcRXb0MrpfD2woqcp', '_9GoGqF8cvVV0RAzR529nkF3XvG', 'PxUqAsdiTIOl41dZFxuXn6vxSn'
Source: FluxusV1.2.2.dr, XTCaTeyQqjqzMqQFw2vCFwVCZf.cs	High entropy of concatenated method names: 'e0eTGJjyteWiHuiyFlwbHW4il0', 'EaEpGw36JMEDJRe3miGBPyMlQ6', 'Aleca4La6EV6C5NWVU8gOZgFRo', 'fgcpLIuTLJ3cU8m37DSBp2vasD', 'xOcfv2pwntCi1mfdOBrZY1BdWS', 'Vl2B24fjdLNgdms6tDas54hBha', 'qsh0GOvE9SVMQCEVL4xpJkQZYO', 'Ikhg0ZKkwT1KaSzqPN7p7g8Hm7', 'GLyOtTQHVPQqJiLuiWs3Lk9ths', 'Z8UuTBtMQNVYsuD3h6DUxI25XY'
Source: FluxusV1.2.2.dr, 1IzZeZTCJbjXCt7H00DOEXEv14.cs	High entropy of concatenated method names: 'FGNIsJmOykr3ePLIvfghdl82rE', 'iFMfNJ8tX7tyyJsVz54nOofmpWqm0UlCHP3Jh2daFxqJ', '_1Aaw4RFWjQVydm3WDNOfGFQjzh3P1B9ILUhqqx2ONVsy', '_4O6xqRfIIC7p2Jv3RL7qNzv5stbSYR9gxRjf6bmaYJzL', 'jQZZVEYz1wKZmlKz32FwUYq8ccFSMpoVymeH0OH4k4ED'
Source: FluxusV1.2.2.dr, 3iX4amOaDratG5dw5gJMaxGLRs3vX58VbCjmcVHxTF0CdB37hd664S3xNqW.cs	High entropy of concatenated method names: 'X62lMf9Fo642ghnpIdH4ryrmWJnk5ojYqcmADta3uxk0WAPMDYottPU2RRE', 'KUJQI2n84phxAWGmHRptJafl2pMbccyfgxCQZWNRzf66ShXdIqnxVf2h9dDXTVqr5J3iM9PQHwr5', 'Blr9tkCYi6BWhPs187jQjtqCes5OTtVjdUIeIC7lmiu8GduDNlPK4ZljZFFQdgrXuXFGKY6x8o1a', 'GQSx9Q50t9YTZplZikXb96OzLV4cbvIcAzqPKYIkAIEQykjMhb1ITIVhkapVudX6GGkzGAu0jlzj', '_0elCUiPfUSuvWL1HLrc9OQRnDOlqPdJLNxIs9Q0sSNmyctfNqVqONUzkFFoPNaTry9gOdWzVPSEW'
Source: FluxusV1.2.2.dr, PJALqz39sBtzbnxazUO1cDrRHY.cs	High entropy of concatenated method names: 'mOybXieFxgzFW9F6hFxCu3WTGx', 'eMjHERXKLY7qr9i73mFZgBF8qw', 'pETlcwsuCpoxf73iWgLO3Vxi24', 'MJCQR8d3ayRI2BknSp97GUcAat', 'LSRD3vXFbk1IZ9Ju2x5mznqT3AzXLifIiiJY4smGb6D3', 'quD5R0BocQVtcgV9g4yiaN3I5qCsayPqqKNoCcWuTUm3', '_2F3jHAgxZJ4g5gPpchtfPtG1dIdS8N4IplRobGtY3ArG', 'ZdciAm8ylkTO2AXVEI4eyxDZGtJSoyTNcqD1xV1a0vMD', 'tkOHTlPXRBlnLb9dk8FEZHFe6W11yoxsvsyk7sfLhcoN', 'jXVDi6SCnWW8SZ4o46fiDxbcKJgSkGyRe8yK1aPg9qCs'
Source: FluxusV1.2.2.dr, HxQC3kYdX0WQPewrh4NuphJzjkffXWvZuGKs1Dpi1vT8jIdLulWj3OXcoG1.cs	High entropy of concatenated method names: 'zz4vBEJbcvwEgGIfmyiut7LrTym3AwtZaTO8JPs7Cc0qFC4HFZ8h49XQUYp', 'UpinnvOruu3DYsOtM7Ik2ELmQz8Ts541mkivta8krXFIUgcvcsDGQi2vNF4', 'WTULDY12DGY3j4RFDHX994Eivlm3gZOo1H50X0aKgnOuKneKosIo3kY8gK5', '_6WR5WhtUNv8vTNugYC68XiqnVNBPQmS5LEHvLHZwZCGHOCMcgPXmNi7XBp1', 'QF6HQhTmfq2t8qh2yKNNy9wgbHt0dTygSjOFmDsPkk11kiZo9HdTNiOP94j', 'K27vHG2YSCvX4IIxlbra0T5qGa5BtyeMoHBMTyMP8TiIYmDUutBTLtAG0n5', 's1RRxCzJyYPsGP2jiTgVKYVW0FYSQSHijzWiQvDU0zRIeDqLWKiZb3QaB0w', 'e2bkoiRpeIASLoQQVIj6ug9f0RIlMqP8FKTbX7IBIi9s37bQcKDGX4mXxF2', 'Y0xP6o7CgV1RDr8A1FMwgYGnhMNfqqw5nFagABz0gBKVIXFCFlJppxnOzdh', 'yHRh8Azo2Diqe4d7KWv4JXD4EFYVegvE0yFh6IhoJtiPPOyrlyBo5daU0KB'

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\Desktop\oIDX88LpSs.exe	File created: C:\Users\user\AppData\Roaming\MyNigga!.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	File created: C:\Users\user\AppData\Roaming\FluxusV1.2	Jump to dropped file
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	File created: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe

File created: C:\Users\user\AppData\Roaming\FluxusV1.2

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FluxusV1" /tr "C:\Users\user\AppData\Roaming\FluxusV1.2"

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FluxusV1.lnk

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FluxusV1.lnk

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FluxusV1			Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FluxusV1			Jump to behavior

Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Memory allocated: 1AB20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Memory allocated: 1AA80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Memory allocated: 1BF524F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Memory allocated: 1BF6C060000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599669	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598795	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598686	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598138	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597917	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597809	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597701	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597369	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597030	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596916	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596258	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595698	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595483	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595374	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595259	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595041	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 594827	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 594718	Jump to behavior

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Window / User API: threadDelayed 5127	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Window / User API: threadDelayed 4703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Window / User API: threadDelayed 7099	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Window / User API: threadDelayed 2735	Jump to behavior

Source: C:\Users\user\Desktop\oIDX88LpSs.exe TID: 4256	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe TID: 6212	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -599669s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -599014s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -598905s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -598795s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -598686s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -598249s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -598138s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -598030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -597917s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -597809s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -597701s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -597369s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -597145s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -597030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -596916s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -596374s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -596258s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -596140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -595921s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -595698s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -595593s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -595483s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -595374s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -595259s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -595041s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -594827s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe TID: 2024	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe TID: 4180	Thread sleep time: -120000s >= -30000s

Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599669	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598795	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598686	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598138	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597917	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597809	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597701	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597369	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 597030	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596916	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596258	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595698	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595483	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595374	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595259	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 595041	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 594827	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Thread delayed: delay time: 594718	Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: SIHClient.exe, 00000011.00000003.2283411928.000001D8D018C000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000011.00000002.2503441289.000001D8D018C000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000011.00000003.2502266911.000001D8D018C000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000011.00000003.2282423906.000001D8D018C000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000011.00000003.2288348083.000001D8D018C000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000011.00000003.2286655909.000001D8D018C000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000011.00000003.2502266911.000001D8D0136000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000011.00000003.2463850046.000001D8D018C000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000011.00000002.2503441289.000001D8D0136000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.14.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin`
Source: BootstrapperV1.22.exe, 00000003.00000002.2253077683.000001BF52432000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllBB"
Source: Amcache.hve.14.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: oIDX88LpSs.exe, 00000000.00000002.2112813400.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r&Prod_VMware_SATA_CD00#4&224f42ef&0
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: MyNigga!.exe, 00000002.00000002.4571486210.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW %SystemRoot%\system32\mswsock.dllingProfile>
Source: Amcache.hve.14.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\oIDX88LpSs.exe

Memory allocated: page read and write | page guard

Yara detected Powershell download and execute

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: Process Memory Space: BootstrapperV1.22.exe PID: 7084, type: MEMORYSTR
Source: Yara match	File source: \Device\ConDrv, type: DROPPED

Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process created: C:\Users\user\AppData\Roaming\MyNigga!.exe "C:\Users\user\AppData\Roaming\MyNigga!.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Process created: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe "C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FluxusV1" /tr "C:\Users\user\AppData\Roaming\FluxusV1.2"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior

Source: C:\Users\user\Desktop\oIDX88LpSs.exe	Queries volume information: C:\Users\user\Desktop\oIDX88LpSs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Queries volume information: C:\Users\user\AppData\Roaming\MyNigga!.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Queries volume information: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation

Source: C:\Users\user\Desktop\oIDX88LpSs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: MyNigga!.exe, 00000002.00000002.4565726642.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp, MyNigga!.exe, 00000002.00000002.4571486210.000000001BC9D000.00000004.00000020.00020000.00000000.sdmp, MyNigga!.exe, 00000002.00000002.4571486210.000000001BC5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\MyNigga!.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 0.2.oIDX88LpSs.exe.2b54ca8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.MyNigga!.exe.9b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oIDX88LpSs.exe.2b42068.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2110723473.00000000009B2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2113525590.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oIDX88LpSs.exe PID: 6220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MyNigga!.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\FluxusV1.2, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\MyNigga!.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 0.2.oIDX88LpSs.exe.2b54ca8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.MyNigga!.exe.9b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oIDX88LpSs.exe.2b42068.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oIDX88LpSs.exe.2b54ca8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oIDX88LpSs.exe.2b42068.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2110723473.00000000009B2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2113525590.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oIDX88LpSs.exe PID: 6220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MyNigga!.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\FluxusV1.2, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\MyNigga!.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	13 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	21 Masquerading	OS Credential Dumping	241 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	33 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
oIDX88LpSs.exe	100%	Avira	TR/Dropper.Gen
oIDX88LpSs.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\FluxusV1.2	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\MyNigga!.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\FluxusV1.2	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\MyNigga!.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	63%	ReversingLabs	Win64.Trojan.Malgent

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
https://www.newtonsoft.com/jsonschema	0%	URL Reputation	safe
https://www.nuget.org/packages/Newtonsoft.Json.Bson	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
getsolara.dev	172.67.203.125	true	false	unknown
d8zyctl.localto.net	185.141.35.22	true	true	unknown
edge-term4-fra2.roblox.com	128.116.123.4	true	false	unknown
www.nodejs.org	104.20.23.46	true	false	unknown
clientsettings.roblox.com	unknown	unknown	false	unknown
18.31.95.13.in-addr.arpa	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://getsolara.dev/asset/discord.json	false	unknown
https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live	false	unknown
https://getsolara.dev/api/endpoint.json	false	unknown
https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:6463	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF5415F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.nodejs.org	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://300fa622.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exex=R	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.com	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ncs.roblox.com/upload	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541D9000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54177000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.nodejs.org	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.14.dr	false	URL Reputation: safe	unknown
https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/raw	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54177000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://james.newtonking.com/projects/json	BootstrapperV1.22.exe.0.dr	false	URL Reputation: safe	unknown
https://300fa622.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541DD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://getsolara.dev	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54115000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.com;http://127.0.0.1:6463/rpc?v=11	BootstrapperV1.22.exe, 00000003.00000000.2112398428.000001BF52102000.00000002.00000001.01000000.00000007.sdmp, BootstrapperV1.22.exe.0.dr	false		unknown
https://aka.ms/vs/17/release/vc_redist.x64.exe	BootstrapperV1.22.exe, 00000003.00000000.2112398428.000001BF52102000.00000002.00000001.01000000.00000007.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe.0.dr	false		unknown
http://127.0.0.1:64632a	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF5415F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://getsolara.dev	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF5410A000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54177000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.newtonsoft.com/jsonschema	BootstrapperV1.22.exe.0.dr	false	URL Reputation: safe	unknown
https://300fa622.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541EF000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541DD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson	BootstrapperV1.22.exe, 00000003.00000000.2112398428.000001BF52102000.00000002.00000001.01000000.00000007.sdmp, BootstrapperV1.22.exe.0.dr	false	URL Reputation: safe	unknown
https://gist.githubusercontent.com/typeshi12/29ef3a44a19235b08aaf229631c024d8/raw	BootstrapperV1.22.exe, 00000003.00000000.2112398428.000001BF52102000.00000002.00000001.01000000.00000007.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54061000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe.0.dr	false		unknown
http://127.0.0.1:6463/rpc?v=1	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF5415F000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MyNigga!.exe, 00000002.00000002.4567320477.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF540FA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://clientsettings.roblox.com	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54177000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541D5000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pastebin.com/raw/pjseRvyK	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF54177000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clientsettings.roblox.com	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://edge-term4-fra2.roblox.com	BootstrapperV1.22.exe, 00000003.00000002.2254936783.000001BF541FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/rawChttps://pastebin.c	BootstrapperV1.22.exe, 00000003.00000000.2112398428.000001BF52102000.00000002.00000001.01000000.00000007.sdmp, BootstrapperV1.22.exe.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.203.125	getsolara.dev	United States	13335	CLOUDFLARENETUS	false
185.141.35.22	d8zyctl.localto.net	Turkey	43260	AS43260TR	true
128.116.123.4	edge-term4-fra2.roblox.com	United States	22697	ROBLOX-PRODUCTIONUS	false
104.20.23.46	www.nodejs.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1537991
Start date and time:	2024-10-20 01:26:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	oIDX88LpSs.exe renamed because original name is a hash value
Original Sample Name:	1648da0c5f6a9b0f99339a225ed9e11e8910f198e44726b920d1872ca1b3972b.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@23/19@6/5
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 95% Number of executed functions: 152 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94, 4.175.87.197, 13.95.31.18, 172.202.163.200, 20.242.39.171, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target BootstrapperV1.22.exe, PID 7084 because it is empty
Execution Graph export aborted for target oIDX88LpSs.exe, PID 6220 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: oIDX88LpSs.exe

Simulations

Behavior and APIs

Time	Type	Description
01:27:03	Task Scheduler	Run new task: FluxusV1 path: C:\Users\user\AppData\Roaming\FluxusV1.2
19:27:01	API Interceptor	53x Sleep call for process: BootstrapperV1.22.exe modified
19:27:01	API Interceptor	13532396x Sleep call for process: MyNigga!.exe modified
19:27:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run FluxusV1 C:\Users\user\AppData\Roaming\FluxusV1.2
19:27:10	API Interceptor	1x Sleep call for process: WerFault.exe modified
19:27:10	API Interceptor	2x Sleep call for process: OpenWith.exe modified
19:27:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run FluxusV1 C:\Users\user\AppData\Roaming\FluxusV1.2
19:27:14	API Interceptor	5x Sleep call for process: SIHClient.exe modified
19:27:18	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FluxusV1.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.203.125	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse
185.141.35.22	PDF.exe	Get hash	malicious	XWorm	Browse
128.116.123.4	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse
	https://shrturl.net/pmf-gx3n	Get hash	malicious	Unknown	Browse
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse
104.20.23.46	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse
	solarabootstrapper.exe	Get hash	malicious	XWorm	Browse
	TK7.vbs	Get hash	malicious	PureLog Stealer, XWorm, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.nodejs.org	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	104.20.23.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
getsolara.dev	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	104.21.93.27
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.203.125
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.203.125
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
edge-term4-fra2.roblox.com	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	128.116.123.3
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	128.116.123.4
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	128.116.123.3
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	128.116.123.3
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse	128.116.123.4
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.123.3
	SolaraBootstrapper.exe	Get hash	malicious	DCRat, XWorm	Browse	128.116.123.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROBLOX-PRODUCTIONUS	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	128.116.123.3
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	128.116.44.3
	https://www.roblox.sc/users/294681399108/profile	Get hash	malicious	Unknown	Browse	128.116.122.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.4
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse	128.116.119.3
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	128.116.123.4
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	128.116.21.3
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	128.116.123.3
CLOUDFLARENETUS	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.206.204
	SecuriteInfo.com.Win64.MalwareX-gen.9093.5876.exe	Get hash	malicious	Unknown	Browse	104.21.80.99
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.28.222
	msvcp110.dll	Get hash	malicious	LummaC	Browse	172.67.147.188
	https://sub.investorscabirigroup.com/4WQbos10596ktJI775idiwtbqpkk1528WGTFCWTFRKDXPVO305927/749609o14	Get hash	malicious	Phisher	Browse	104.19.229.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
AS43260TR	SecuriteInfo.com.Trojan.WinGo.Agent.15048.57.exe	Get hash	malicious	Unknown	Browse	77.73.131.68
	SecuriteInfo.com.Win64.Malware-gen.27001.18486.exe	Get hash	malicious	Unknown	Browse	77.73.131.68
	SecuriteInfo.com.Trojan.WinGo.Agent.15048.57.exe	Get hash	malicious	Unknown	Browse	77.73.131.68
	SecuriteInfo.com.Win64.Malware-gen.27001.18486.exe	Get hash	malicious	Unknown	Browse	77.73.131.68
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	185.124.86.109
	0d145776475200f49119bfb3ac7ac4dd4e20fadd0fd7b.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.122.203.107
	e416c0d0e2c49f0d5582d90727781330a012ebe541a60.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.122.203.107
	https://www.google.com/url?q=https://www.google.com/url?q%3DdCSMjVnvsqsqaP8pEWWm%26rct%3DSpPq9HncUaCXUtCZusX0%26sa%3Dt%26esrc%3DuZR6jk9A67Rj7RZhLuPE%26source%3D%26cd%3Deh0xIKCKpKh7i4kTt26p%26cad%3DVEVtMkQKVNr1KW4fxShi%26ved%3DNTDACygNXetEDbRT8YiY%26uact%3D%2520%26url%3Damp%252Fzarafetbayankuafor%252Ecom%252F.rr%252F&source=gmail&ust=1726081152301000&usg=AOvVaw13bOFWGbYMslwWZ8DW3Ey1#vauFEE-SUREDANNXSnVzdGluLkdhcmNpYUBwZXJyeWhvbWVzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	185.71.218.12
	https://www.google.com/url?q=https://www.google.com/url?q%3DdCSMjVnvsqsqaP8pEWWm%26rct%3DSpPq9HncUaCXUtCZusX0%26sa%3Dt%26esrc%3DuZR6jk9A67Rj7RZhLuPE%26source%3D%26cd%3Deh0xIKCKpKh7i4kTt26p%26cad%3DVEVtMkQKVNr1KW4fxShi%26ved%3DNTDACygNXetEDbRT8YiY%26uact%3D%2520%26url%3Damp%252Fzarafetbayankuafor%252Ecom%252F.rr%252F&source=gmail&ust=1726081152301000&usg=AOvVaw13bOFWGbYMslwWZ8DW3Ey1#TAPW7E-SUREDANNXYW1pc2guc2FuZ2hyYWprYUBpbi55b2tvZ2F3YS5jb20=	Get hash	malicious	HTMLPhisher	Browse	185.71.218.12
	https://www.google.com/url?q=https://www.google.com/url?q%3DdCSMjVnvsqsqaP8pEWWm%26rct%3DSpPq9HncUaCXUtCZusX0%26sa%3Dt%26esrc%3DuZR6jk9A67Rj7RZhLuPE%26source%3D%26cd%3Deh0xIKCKpKh7i4kTt26p%26cad%3DVEVtMkQKVNr1KW4fxShi%26ved%3DNTDACygNXetEDbRT8YiY%26uact%3D%2520%26url%3Damp%252Fzarafetbayankuafor%252Ecom%252F.rr%252F&s	Get hash	malicious	Unknown	Browse	185.71.218.12

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	N2ER4ZENF1.exe	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	N2ER4ZENF1.exe	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	SecuriteInfo.com.Win64.Evo-gen.14681.29745.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	SecuriteInfo.com.Win64.MalwareX-gen.18133.14409.exe	Get hash	malicious	Discord Rat	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	cAHHSnHDJS.exe	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	cAHHSnHDJS.exe	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	01oTkKQVSW.exe	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	WeLyNA2xUj.exe	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.123.4 104.20.23.46

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BootstrapperV1.2_8a67a53847f1550bba47f83cc7f50ab9fda1622_30d98452_fa610ae8-e7ba-42f0-96f3-633ff79e81bf\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2682737302157336
Encrypted:	false
SSDEEP:	192:Yfldir0bU9+dQtaWxejol2/fsLzuiFoZ24lO8E:old9bG+dQtaml23sLzuiFoY4lO8E
MD5:	BCC991493CDE3DCB2FBE02E7B9B970AF
SHA1:	E448DA9B4BFF1A5362019EF3402D7513D3E37607
SHA-256:	80D35E0F587A3230AF3E5037A0925757C92DD7AF4432C115876687BF51E590B3
SHA-512:	9DF3F805475BE838CCD5E412CB57323DE04B3433913CCD99433DA59E12B55E4C78BF4CBB0B9BFED6FBCD4318955BD394282EA18CA63677B0EFE45C421A5EB3DF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.8.5.4.0.2.7.0.5.2.4.7.0.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.8.5.4.0.2.7.7.3.9.9.7.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.6.1.0.a.e.8.-.e.7.b.a.-.4.2.f.0.-.9.6.f.3.-.6.3.3.f.f.7.9.e.8.1.b.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.6.5.4.d.3.d.-.6.0.1.a.-.4.3.1.2.-.b.1.a.9.-.e.6.6.2.0.5.2.7.c.8.f.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.B.o.o.t.s.t.r.a.p.p.e.r.V.1...2.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.o.l.a.r.a.B.o.o.t.s.t.r.a.p.p.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.a.c.-.0.0.0.1.-.0.0.1.5.-.9.8.c.a.-.9.3.6.3.7.e.2.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.f.e.1.7.3.6.3.1.c.a.d.c.4.a.7.6.9.5.d.3.9.9.5.7.a.1.2.d.e.9.c.0.0.0.0.0.0.0.0.!.0.0.0.0.2.1.f.2.3.2.c.2.f.d.8.1.3.2.f.8.6.7.7.e.5.3.2.5.8.5.6.2.a.d.9.8.b.4.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD84A.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sat Oct 19 23:27:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	602238
Entropy (8bit):	3.3163330382474223
Encrypted:	false
SSDEEP:	6144:/STmF5Yyd5AzvhyYLWOrHZTMHqssCq983/5YLt3QLcg:tJAVyYLWUGlqXRQ
MD5:	173E1C9437C38CB6305B791CB4FC5FCF
SHA1:	1FB9EB86137F4BF38A893DD10E292FE2F8500F21
SHA-256:	812BA6A0DCE66E3B81860B50D97164F108DA390C7025C150B00C6E76A317706E
SHA-512:	D1AC93CB468EE3F259E751E70AA34BE8BF48ADCDEA6D6C8BB1D50E82FFA7AFBBED38BD46A5B8193A7E88308D3864568ED5C96316CB4741B9E692FFF4264B6EA4
Malicious:	false
Preview:	MDMP..a..... .......K@.g............4...........<...T.......<....)...........).......T..............l.......8...........T............U...............E...........G..............................................................................eJ......@H......Lw......................T...........@@.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA4F.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6812
Entropy (8bit):	3.722184788892126
Encrypted:	false
SSDEEP:	192:R6l7wVeJOjDZEwSvCYZE82prK89bneb0UfqNejm:R6lXJADZEwSvCYGDnebvfce6
MD5:	38041656EA128E3A7A87D3B4A2332F31
SHA1:	9FA35B45D0C201AC22264A315AAB661893DE274E
SHA-256:	2D1CF222C864CC0CFE988A5F21BBE9E88582CF57CBC153EF9030A8228B42EF8A
SHA-512:	27F4B515A8AEFF166B37E4957473E2A30CAA45C0AE10E2FBB6F4C180C70C140626DB69D29EABE0D730E4712DFEBD92657532041199D2704E0233381FDF120E09
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA6F.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4834
Entropy (8bit):	4.466169616715466
Encrypted:	false
SSDEEP:	48:cvIwWl8zsSNJg771I96dWpW8VYh1Ym8M4JQDCT/FuFPyq8vaCTw1yioivd:uIjfSnI7Vs7VkEJyWc1vdvd
MD5:	3D7D6CE888D46028CD78D5A1193B87D1
SHA1:	63579CD779E2E3DCE831CDBA1493608A06978344
SHA-256:	DB3EEEA37B11E3DD5E6B202AE91FF8875C393CD1BF33C6DD943ED5BD5083545A
SHA-512:	405A2354E9CC6CFC86729536E363150FCD4529426FA3EB32E7EB783E21408615BE538B3FBA67EC59E5CA64C9B9F7816B6430323F3BAF1BE949C7FC1112EE1766
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="550949" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\oIDX88LpSs.exe.log

Process:	C:\Users\user\Desktop\oIDX88LpSs.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\AppData\Roaming\MyNigga!.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	3.7195394315431693
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr4rNrn:EFYJKDoWrcBn
MD5:	0DB526D48DAB0E640663E4DC0EFE82BA
SHA1:	17AC435DAFEA6FF9F4D6F83FA6C54F9800F43724
SHA-256:	934290A76F9E1804069D8ED6515B14101D9D8ABA2EACBF5B260F59941C65340E
SHA-512:	FACD013E1B5B8163214CA8C3A18ADEEC3541153CD69240EEFA76DDD54809186E919C1D635AEA648A8641DE7C3216BEC11C41F04719B60F07EDFDC01FF79027B9
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]r[WIN]r

C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe

Process:	C:\Users\user\Desktop\oIDX88LpSs.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	819200
Entropy (8bit):	5.598226996524291
Encrypted:	false
SSDEEP:	12288:t0zVvgDNMoWjTmFzAzBocaKjyWtiR1pptHxQ0z:O5vgHWjTwAlocaKjyyItHDz
MD5:	2A4DCF20B82896BE94EB538260C5FB93
SHA1:	21F232C2FD8132F8677E53258562AD98B455E679
SHA-256:	EBBCB489171ABFCFCE56554DBAEACD22A15838391CBC7C756DB02995129DEF5A
SHA-512:	4F1164B2312FB94B7030D6EB6AA9F3502912FFA33505F156443570FC964BFD3BB21DED3CF84092054E07346D2DCE83A0907BA33F4BA39AD3FE7A78E836EFE288
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: hKWBNgRd7p.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe, Detection: malicious, Browse Filename: 8svMXMXNRn.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...Ll.g.........."......v............... ....@...... ....................................`.................................................D...T.......u............................................................................................ ..H............text....t... ...v.................. ..`.rsrc...u............x..............@..@.reloc...............~..............@..BH........................................................................0..R.......(....:....r...p(....r...po....:-...r-..pr&..p.. (.....@....r...pr<..p(....(....&.......0..........rL..prT..p.(....s....%.o....%.o....%.o....%.o.....s.......o.....o....&.o....o......(....9.....o....o.............9.....o.............8.8p.......0..8.......r\..p.......%...%.r^..p.%...%.r...p.%...%.r...p.(...........(....~....%:....&~.........s....%.....(...+...0..l.........(....r...p(....(....r\..p.

C:\Users\user\AppData\Roaming\FluxusV1.2

Process:	C:\Users\user\AppData\Roaming\MyNigga!.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	5.963935667866813
Encrypted:	false
SSDEEP:	1536:169PNjj6/hQzpeexAniS5f0E+be9EnQCY0Pww51VONXLxsB2:1INjmOpT4iK3+be9dCYswWONbu2
MD5:	2B3B90E6EED13A7E4E2F8285F0022F94
SHA1:	5528FA9BC71D52D3E03A09683E5AF51BDE7DE8AE
SHA-256:	3477E2B340DC3B15EC23D29ADBF5306D6D3D537F26AF90729E0305B2F746CD7D
SHA-512:	41714DE449B7722080BCB7398542C143345B5C1C03A5DB490EE7D15DE07A9C76107BA285CA9FF92734BF751E4693F4B408E951EC3C2A78D7A300692EFBD53B85
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\FluxusV1.2, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\FluxusV1.2, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..g................."...........A... ...`....@.. ....................................@.................................XA..S....`............................................................................... ............... ..H............text....!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................A......H.......T^..........&.....................................................(.....r...p. \.p...(.....ry..p. ..9..s.........s.........s.........s..........r...p. ..>..r-..p. ~.H..r...p. .W...r...p. .O...r;..p. .8F...((....r...p. .....r...p. ..."(....+.&(....&+..+5sT... .... .'..oU...(,...~....-.(D...(6...~....oV...&.-..r...p. .3 ..rO..p. p{..r...p. .....r...p.r]..p. .0................j..................sW.............."(F...+.:.t....(A...+.*

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FluxusV1.lnk

Process:	C:\Users\user\AppData\Roaming\MyNigga!.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Oct 19 22:27:01 2024, mtime=Sat Oct 19 22:27:01 2024, atime=Sat Oct 19 22:27:01 2024, length=76800, window=hide
Category:	dropped
Size (bytes):	762
Entropy (8bit):	5.070113786464254
Encrypted:	false
SSDEEP:	12:806Q+QslEg4lf7Bpnu8ChWilXIsY//FpLPCGKOmlNbVjAr//s+HgYKokomV:8jQ+QEMNHDFilXUzPCdOm9Aj/sMKbom
MD5:	5766465E844DD965742D022237F757E2
SHA1:	F0DD0C66629D366D9E59E38EB2502A63977A0FBB
SHA-256:	225F5ECC0AAB5855DD30443CFC844E5E2D24BD3F72B2B7B069433DDBB486D8F7
SHA-512:	40ADC7229C314AEF1CF8626ACB7563588874F53A4D163011A017ABE1B945AD89141EC82F2569736BA8FFA90099BB16A451254F76B5A5E4C3EBD4F98285EBA185
Malicious:	false
Preview:	L..................F.... ..._..e~".._..e~".._..e~"...,......................t.:..DG..Yr?.D..U..k0.&...&.......$..S.....^~"..7{?f~"......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2SY[............................^.A.p.p.D.a.t.a...B.V.1.....SY]...Roaming.@......EW<2SY]...../.........................R.o.a.m.i.n.g.....`.2..,..SYa. .FluxusV1.2..F......SYa.SYa.....f ........................F.l.u.x.u.s.V.1...2.......[...............-.......Z...........sL.......C:\Users\user\AppData\Roaming\FluxusV1.2........\.....\.....\.....\.....\.F.l.u.x.u.s.V.1...2.`.......X.......562258...........hT..CrF.f4... ....Jc...-...-$..hT..CrF.f4... ....Jc...-...-$.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\MyNigga!.exe

Process:	C:\Users\user\Desktop\oIDX88LpSs.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	5.963935667866813
Encrypted:	false
SSDEEP:	1536:169PNjj6/hQzpeexAniS5f0E+be9EnQCY0Pww51VONXLxsB2:1INjmOpT4iK3+be9dCYswWONbu2
MD5:	2B3B90E6EED13A7E4E2F8285F0022F94
SHA1:	5528FA9BC71D52D3E03A09683E5AF51BDE7DE8AE
SHA-256:	3477E2B340DC3B15EC23D29ADBF5306D6D3D537F26AF90729E0305B2F746CD7D
SHA-512:	41714DE449B7722080BCB7398542C143345B5C1C03A5DB490EE7D15DE07A9C76107BA285CA9FF92734BF751E4693F4B408E951EC3C2A78D7A300692EFBD53B85
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\MyNigga!.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\MyNigga!.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..g................."...........A... ...`....@.. ....................................@.................................XA..S....`............................................................................... ............... ..H............text....!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................A......H.......T^..........&.....................................................(.....r...p. \.p...(.....ry..p. ..9..s.........s.........s.........s..........r...p. ..>..r-..p. ~.H..r...p. .W...r...p. .O...r;..p. .8F...((....r...p. .....r...p. ..."(....+.&(....&+..+5sT... .... .'..oU...(,...~....-.(D...(6...~....oV...&.-..r...p. .3 ..rO..p. p{..r...p. .....r...p.r]..p. .0................j..................sW.............."(F...+.:.t....(A...+.*

C:\Users\user\Desktop\DISCORD

Process:	C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.081427527984575
Encrypted:	false
SSDEEP:	3:XSWHlkHFWKBgdvHvIhN9GIxFf9oQg652UTF/HLMl1m:XSWHlW0aivQLkWFfx/52uyPm
MD5:	B016DAFCA051F817C6BA098C096CB450
SHA1:	4CC74827C4B2ED534613C7764E6121CEB041B459
SHA-256:	B03C8C2D2429E9DBC7920113DEDF6FC09095AB39421EE0CC8819AD412E5D67B9
SHA-512:	D69663E1E81EC33654B87F2DFADDD5383681C8EBF029A559B201D65EB12FA2989FA66C25FA98D58066EAB7B897F0EEF6B7A68FA1A9558482A17DFED7B6076ACA
Malicious:	false
Preview:	{. "args" : {. "code" : "8PgspRYAQu". },. "cmd" : "INVITE_BROWSER",. "nonce" : ".". }

C:\Windows\Logs\SIH\SIH.20241019.192712.092.1.etl

Process:	C:\Windows\System32\SIHClient.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	2.858529242446535
Encrypted:	false
SSDEEP:	96:FEgEBIv6J/Uw0y+Jw0srqNn9vcP9NcH9Rwew+Az8UNzJLjwaAsJ:FEr06J/U1y8JRNndMvQXPwZBNzJzAsJ
MD5:	4F9CAB11BEE5D97EE748D1A9119D2A61
SHA1:	39D62B6B675F729C4C16B74EB15A57F7A2624ADA
SHA-256:	97B8F4473BBDE06FCC365704C99D157F37A73CAF5F399D7735E570ABD671AB8D
SHA-512:	DDE05865CC8F491C5F95E2C15CF9AD42D2D8F4C33CDA80B0C60336F61228E06EB50F09847B0D616782B96C9AC65760E4294DA450E7FDFBE170663BF4D0D09A1D
Malicious:	false
Preview:	....P...P.......................................P...!...............................8.........................eJ......u..z~"..Zb....... ......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................FpTW..............l~"..........S.I.H._.t.r.a.c.e._.l.o.g...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.S.I.H.\.S.I.H...2.0.2.4.1.0.1.9...1.9.2.7.1.2...0.9.2...1...e.t.l.......P.P.....8.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMP69BD.tmp

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 462 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 31944, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	17126
Entropy (8bit):	7.3117215578334935
Encrypted:	false
SSDEEP:	192:D5X8WyNHDHFzqDHt8AxL5TKG+tJSdqnajapCNjFZYECUqY7oX9qhnJSdqnaja2Sl:qDlsHq4ThPdlmY9CUiqOdlm2W
MD5:	1B6460EE0273E97C251F7A67F49ACDB4
SHA1:	4A3FDFBB1865C3DAED996BDB5C634AA5164ABBB8
SHA-256:	3158032BAC1A6D278CCC2B7D91E2FBC9F01BEABF9C75D500A7F161E69F2C5F4A
SHA-512:	3D256D8AC917C6733BAB7CC4537A17D37810EFD690BCA0FA361CF44583476121C9BCCCD9C53994AE05E9F9DFF94FFAD1BB30C0F7AFF6DF68F73411703E3DF88A
Malicious:	false
Preview:	MSCF............D................\|...............A..........d.......................environment.xml.....b...CK..ao.0...J...&.q...-..;+.6+-i.......7.....=....g.P.RQ.#..#...QQ..p.kk..qX..)...T.....zL#<.4......\k..f..,.Q...`..K7.hP..".E.53.V.DW.X).z.=`.COO 8..8.......!$.P!`00....E.m..l .)".J.vC..J..&...5.5(.a..!..MIM.........z.;......t.<.o..\|CR.3>..n.;8dX....:....N.....U.......J.I(vT..3...N....$.._^.A<....&=._(N....m.u.1}.....Ax.b8....q~.i..0.A....H........A.0.@....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...,..gK.........(...._`Oa..;%.010...`.H.e....... K...,.%@.b./.a...Q.:..E.7....V~....0...0..........3....!.G~&.9......0....H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.20...190502214449Z..200502214449Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0...

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMPA192.tmp

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 462 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 31944, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	17126
Entropy (8bit):	7.3117215578334935
Encrypted:	false
SSDEEP:	192:D5X8WyNHDHFzqDHt8AxL5TKG+tJSdqnajapCNjFZYECUqY7oX9qhnJSdqnaja2Sl:qDlsHq4ThPdlmY9CUiqOdlm2W
MD5:	1B6460EE0273E97C251F7A67F49ACDB4
SHA1:	4A3FDFBB1865C3DAED996BDB5C634AA5164ABBB8
SHA-256:	3158032BAC1A6D278CCC2B7D91E2FBC9F01BEABF9C75D500A7F161E69F2C5F4A
SHA-512:	3D256D8AC917C6733BAB7CC4537A17D37810EFD690BCA0FA361CF44583476121C9BCCCD9C53994AE05E9F9DFF94FFAD1BB30C0F7AFF6DF68F73411703E3DF88A
Malicious:	false
Preview:	MSCF............D................\|...............A..........d.......................environment.xml.....b...CK..ao.0...J...&.q...-..;+.6+-i.......7.....=....g.P.RQ.#..#...QQ..p.kk..qX..)...T.....zL#<.4......\k..f..,.Q...`..K7.hP..".E.53.V.DW.X).z.=`.COO 8..8.......!$.P!`00....E.m..l .)".J.vC..J..&...5.5(.a..!..MIM.........z.;......t.<.o..\|CR.3>..n.;8dX....:....N.....U.......J.I(vT..3...N....$.._^.A<....&=._(N....m.u.1}.....Ax.b8....q~.i..0.A....H........A.0.@....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...,..gK.........(...._`Oa..;%.010...`.H.e....... K...,.%@.b./.a...Q.:..E.7....V~....0...0..........3....!.G~&.9......0....H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.20...190502214449Z..200502214449Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0...

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\sls.cab

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 7826 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 53283, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	24490
Entropy (8bit):	7.629144636744632
Encrypted:	false
SSDEEP:	384:iarwQcY8StpA7IQ6GCq30XPSIleI7lzCuqvfiSIleIx:iartHA7PCFP66Tqvfi6c
MD5:	ACD24F781C0C8F48A0BD86A0E9F2A154
SHA1:	93B2F4FBF96D15BE0766181AFACDB9FD9DD1B323
SHA-256:	5C0A296B3574D170D69C90B092611646FE8991B8D103D412499DBE7BFDCCCC49
SHA-512:	7B1D821CF1210947344FCF0F9C4927B42271669015DEA1C179B2BEAD9025941138C139C22C068CBD7219B853C80FA01A04E26790D8D76A38FB8BEBE20E0A2A4A
Malicious:	false
Preview:	MSCF............D...............#................A..........d........B..............environment.cab.x.\&..BCK.\.T...N.....;LB.JW.. .w!....$...U....."........ (.. E..........w...e.Jf.3gN.{...{V.M4.!.....hn. p(... .a...f..f..j.....Kh5..l.DB\}.=.0.>..X.....z..,'..LC/>....h.>.>.........,~mVI.....'EGD]^..\{....Q....f...4.F.....q..FF.1~...Q,.."g.qq.......}.....g%Zz.;m.9..z../2Jl.p8wGO......-V....FM......y.....Hy.xy......N.r;.@uV........Xa...b].`..F...y.Wd.e.8.[Z.s7].....=B.$...'.\|.-.sC....a_(..$..i.C.T.F}...]...m.R,y.1...'..j3.....ir..B..)sR.G...`-=.w....m..2y.....o...\{..C.4.:ZM..wL-$.I.x:?.!.....:..W.%&.....J.%.....~....E..T.d.Q{..p..J..pY...P../.."rp....`...#w.....'.\|n%Dy,.....i....."..x.....b._..\_.^.XOo..*:.&a.`..qA.?.@..t.R/...X3.nF.&........1Z.r.S...9x........?..aP..A...f..k:..\....L...t....Q...1..A..33A1.t..)...c....;......$.$..>._....A.!g`..t...b.H.L..&.....!......v~.n...uE.x...."5.h.4..B.R.d.4.%--.`.B..."..[....l......x(..5......@.zr....

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP1BA5.tmp

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 858 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 12183, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	19826
Entropy (8bit):	7.454351722487538
Encrypted:	false
SSDEEP:	384:3j+naF6zsHqnltHNsAR9zCfsOCUPTNbZR9zOzD8K:z1F6JLts89zIdrFT9zwoK
MD5:	455385A0D5098033A4C17F7B85593E6A
SHA1:	E94CC93C84E9A3A99CAD3C2BD01BFD8829A3BCD6
SHA-256:	2798430E34DF443265228B6F510FC0CFAC333100194289ED0488D1D62C5367A7
SHA-512:	104FA2DAD10520D46EB537786868515683752665757824068383DC4B9C03121B79D9F519D8842878DB02C9630D1DFE2BBC6E4D7B08AFC820E813C250B735621A
Malicious:	false
Preview:	MSCF....Z.......D................/..........Z....J..........d.......................environment.xml........CK....8.....w..=.9%T`.eu:.jn.E.8......m_.o?...5.K.{.3X3....^.{i..b......{.+.....y:..KW;;\..n.K=.]k..{.=..3......D$.&IQH.$-..8.r.{..HP.........g....^..~......e.f2^..N.`.B..o.t....z..3..[#..{S.m..w....<M...j..6.k.K.....~.SP.mx..;N.5..~\.[.!gP...9r@"82"%.B%..<2.c....vO..hB.Fi....{...;.}..f\|..g.7..6..].7B..O..#d..]Ls.k..Le...2...&I.Q.,....0.\.-.#..L%.Z.G..K.tU.n...J..TM....4....~...:..2.X..p.d....&.Bj.P(.."..).s.d....W.=n8...n...rr..O._.yu...R..$....[...=H"K<.`.e...d.1.3.gk....M..<R......%1BX.[......X.....q......:...3..w....QN7. .qF..A......Q.p...G...JtL...8sr.s.eQ.zD.u...s.....tjj.G.....Fo...f`Bb<.]k..e.b..,......1.:-....K.......M..;....(,.W.V(^_.....9.,`\|...9...>..R...2\|.\|5.r....n.y>wwU..5...0.J....H........J.0.I....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...>^..~a..e.D.V.C...

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\sls.cab

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 11149 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 18779, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	30005
Entropy (8bit):	7.7369400192915085
Encrypted:	false
SSDEEP:	768:ouCAyCeQ8fkZdfTGo/its89z8gjP69zA4:Aqf56z8HzT
MD5:	4D7FE667BCB647FE9F2DA6FC8B95BDAE
SHA1:	B4B20C75C9AC2AD00D131E387BCB839F6FAAABCA
SHA-256:	BE273EA75322249FBF58C9CAD3C8DA5A70811837EF9064733E4F5FF1969D4078
SHA-512:	DDB8569A5A5F9AD3CCB990B0A723B64CEE4D49FA6515A8E5C029C1B9E2801F59259A0FC401E27372C133952E4C4840521419EF75895260FA22DFF91E0BE09C02
Malicious:	false
Preview:	MSCF.....+......D...............[I...........+...I..........d.......rM..............environment.cab...Q.!+rMCK.\|.XT....CI7.....AR..$..C$D....RA:....T..........o...g...>.....s....z...>..<...J.R.A......%}..... 0............\...e.z...@..{..,./.:9:X8.s^q...>.(]...I)....'..v@....!.(.i.n.!.g.8\/.+X3.E.~.pi...Q...B...."Oj..~.:....M....uB.}..v.WR........tDD......D7..j..`..5..E.2.z..C....4.s....r..Y.:.\|.mtg...S..b._.....!.~Kn..E.=...x.N..e.)....xz...p..h.;..xR'...U.}........nK.+.Y........p..r _.;?.m}$..%&...8. 7..T....,7..F...e...kI.y...q....".W.W..[..gZQ.....W.$k.T"...N....5.R...,+...u.~VO...R-......H7..9........].K....]....tS~.LSi....T....3+........k......i.J.y...,.Y\|.N.t.LX.....zu..8......S7..{y.m.....Ob.....^.S8Kn.i.._.c~.x.ce.A...t........S.......i1......V..S]H....$..J....E..j...4...o.$..).....;.n<.b.}.(.J.]...Q..u,.-.Bm.[z.j..-i.."...._v.......N..+...g..v..../...;G.Yw....0..u...z....J..K.E..s&..u.h3.]J.G............Z....=.N.X..

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46892107818621
Encrypted:	false
SSDEEP:	6144:jzZfpi6ceLPx9skLmb0fNZWSP3aJG8nAgeiJRMMhA2zX4WABluuN2jDH5S:fZHtNZWOKnMM6bFpUj4
MD5:	3E5D632420B8EE4F22BB7F2AB7A148FA
SHA1:	1FD674971DA637AF9B79A826CE51E8956E93A6C7
SHA-256:	429E6E262B83EAB7D20BCBE495EA952C6CA9372D9649B76B3B432B88608367B4
SHA-512:	90405619033A1E0F1D0D183401E91E48792A46CC66134F01EA86DFF39DB64419B876B6E5589B99AFC3A65D7680B143E50853DCE70D9D57353B115D738C465192
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..i~".............................................................................................................................................................................................................................................................................................................................................."..]........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Process:	C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	571
Entropy (8bit):	4.9398118662542965
Encrypted:	false
SSDEEP:	12:t+3p+t/hQAOfVaOQsXCzLQ8X+UwkY1v3igBe:Yot/h+ltcQy+UwkY1vdBe
MD5:	5294778E41EE83E1F1E78B56466AD690
SHA1:	348B8B4687216D57B8DF59BBCEC481DC9D1E61A6
SHA-256:	3AC122288181813B83236E1A2BCB449C51B50A3CA4925677A38C08B2FC6DF69C
SHA-512:	381FB6F3AA34E41C17DB3DD8E68B85508F51A94B3E77C479E40AD074767D1CEAE89B6E04FB7DD3D02A74D1AC3431B30920860A198C73387A865051538AE140F1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: \Device\ConDrv, Author: Joe Security
Preview:	.............................................................------------------------.. ..[-] Fetching endpoint.....[-] Bootstrapper up to date...[-] Killing conflicting processes.....[-] Ensuring essential directories.....[-] Ensuring essential dependencies.....[-] Downloading node......Unhandled Exception: System.Net.WebException: The operation has timed out.. at System.Net.WebClient.DownloadFile(Uri address, String fileName).. at Program.DownloadAndInstallNode().. at Program.EnsureDependencies().. at Program.Main(String[] args).

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.864900901349677
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	oIDX88LpSs.exe
File size:	1'073'664 bytes
MD5:	14461f84b8fca58f2a3a6fdc884582fb
SHA1:	d948c2cd7f8bf46526ab689a6a590fdb0bdf56fc
SHA256:	1648da0c5f6a9b0f99339a225ed9e11e8910f198e44726b920d1872ca1b3972b
SHA512:	e236b264d26f9d5a32a717b2fbde87974fad62b16033b75d8618cb1706f2d84c3db4a9eea2d1e03931e641a0ac03f8da05c4565a97d0e550585a7ca50e5bb129
SSDEEP:	24576:cyUNcU5WXKit+nv6lTf0LmBYL4t67gPjR596:cJNcUkKituvMTf0LmEg59
TLSH:	B735F17566A199CFD3811B3CF8D8373440BC5BFAA8E3E2C4BD36A896AE217055C81CD5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g................................. ........@.. ....................................@................................

File Icon


Icon Hash:	e4e9d4f0d0e972c7

Static PE Info

General

Entrypoint:	0x4dfd8e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6713B788 [Sat Oct 19 13:43:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdfd3c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe0000	0x27e9a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x108000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xddd94	0xdde00	e490e83c7c4b6156965abd2b151d28c5	False	0.9396181778169014	data	7.997455883815368	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe0000	0x27e9a	0x28000	c4c05d2bba211894d8d3c3310e00543c	False	0.40152587890625	data	5.659637494088809	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x108000	0xc	0x200	6855264c8e665ac5afdbb18580876da0	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xe0130	0x27928	Device independent bitmap graphic, 204 x 384 x 32, image size 156672	0.40137456196633925
RT_GROUP_ICON	0x107a58	0x14	data	1.1
RT_VERSION	0x107a6c	0x244	data	0.4706896551724138
RT_MANIFEST	0x107cb0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T01:27:02.576210+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49713	172.67.203.125	443	TCP
2024-10-20T01:27:20.540928+0200	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49744	185.141.35.22	3631	TCP
2024-10-20T01:27:30.897030+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49744	185.141.35.22	3631	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 01:26:58.749413013 CEST	49710	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:26:58.749500036 CEST	443	49710	172.67.203.125	192.168.2.6
Oct 20, 2024 01:26:58.749592066 CEST	49710	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:26:58.810636044 CEST	49710	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:26:58.810677052 CEST	443	49710	172.67.203.125	192.168.2.6
Oct 20, 2024 01:26:59.444818974 CEST	443	49710	172.67.203.125	192.168.2.6
Oct 20, 2024 01:26:59.444932938 CEST	49710	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:26:59.450403929 CEST	49710	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:26:59.450433016 CEST	443	49710	172.67.203.125	192.168.2.6
Oct 20, 2024 01:26:59.450701952 CEST	443	49710	172.67.203.125	192.168.2.6
Oct 20, 2024 01:26:59.505688906 CEST	49710	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:26:59.551397085 CEST	443	49710	172.67.203.125	192.168.2.6
Oct 20, 2024 01:26:59.696527958 CEST	443	49710	172.67.203.125	192.168.2.6
Oct 20, 2024 01:26:59.696804047 CEST	443	49710	172.67.203.125	192.168.2.6
Oct 20, 2024 01:26:59.697259903 CEST	49710	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:26:59.713936090 CEST	49710	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:27:01.780672073 CEST	49713	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:27:01.780721903 CEST	443	49713	172.67.203.125	192.168.2.6
Oct 20, 2024 01:27:01.780793905 CEST	49713	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:27:01.781510115 CEST	49713	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:27:01.781524897 CEST	443	49713	172.67.203.125	192.168.2.6
Oct 20, 2024 01:27:02.029508114 CEST	49714	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:02.034465075 CEST	3631	49714	185.141.35.22	192.168.2.6
Oct 20, 2024 01:27:02.034554958 CEST	49714	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:02.237344980 CEST	49714	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:02.242532969 CEST	3631	49714	185.141.35.22	192.168.2.6
Oct 20, 2024 01:27:02.400341034 CEST	443	49713	172.67.203.125	192.168.2.6
Oct 20, 2024 01:27:02.400427103 CEST	49713	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:27:02.402400017 CEST	49713	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:27:02.402407885 CEST	443	49713	172.67.203.125	192.168.2.6
Oct 20, 2024 01:27:02.402631998 CEST	443	49713	172.67.203.125	192.168.2.6
Oct 20, 2024 01:27:02.404201984 CEST	49713	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:27:02.447416067 CEST	443	49713	172.67.203.125	192.168.2.6
Oct 20, 2024 01:27:02.576214075 CEST	443	49713	172.67.203.125	192.168.2.6
Oct 20, 2024 01:27:02.576292992 CEST	443	49713	172.67.203.125	192.168.2.6
Oct 20, 2024 01:27:02.576380014 CEST	49713	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:27:02.576967955 CEST	49713	443	192.168.2.6	172.67.203.125
Oct 20, 2024 01:27:02.935857058 CEST	49715	443	192.168.2.6	128.116.123.4
Oct 20, 2024 01:27:02.935952902 CEST	443	49715	128.116.123.4	192.168.2.6
Oct 20, 2024 01:27:02.936103106 CEST	49715	443	192.168.2.6	128.116.123.4
Oct 20, 2024 01:27:02.936373949 CEST	49715	443	192.168.2.6	128.116.123.4
Oct 20, 2024 01:27:02.936397076 CEST	443	49715	128.116.123.4	192.168.2.6
Oct 20, 2024 01:27:03.813427925 CEST	443	49715	128.116.123.4	192.168.2.6
Oct 20, 2024 01:27:03.813796043 CEST	49715	443	192.168.2.6	128.116.123.4
Oct 20, 2024 01:27:03.815511942 CEST	49715	443	192.168.2.6	128.116.123.4
Oct 20, 2024 01:27:03.815521002 CEST	443	49715	128.116.123.4	192.168.2.6
Oct 20, 2024 01:27:03.815887928 CEST	443	49715	128.116.123.4	192.168.2.6
Oct 20, 2024 01:27:03.817070961 CEST	49715	443	192.168.2.6	128.116.123.4
Oct 20, 2024 01:27:03.863393068 CEST	443	49715	128.116.123.4	192.168.2.6
Oct 20, 2024 01:27:04.284691095 CEST	443	49715	128.116.123.4	192.168.2.6
Oct 20, 2024 01:27:04.284784079 CEST	443	49715	128.116.123.4	192.168.2.6
Oct 20, 2024 01:27:04.284840107 CEST	49715	443	192.168.2.6	128.116.123.4
Oct 20, 2024 01:27:04.285238028 CEST	49715	443	192.168.2.6	128.116.123.4
Oct 20, 2024 01:27:05.837636948 CEST	49719	443	192.168.2.6	104.20.23.46
Oct 20, 2024 01:27:05.837663889 CEST	443	49719	104.20.23.46	192.168.2.6
Oct 20, 2024 01:27:05.837759018 CEST	49719	443	192.168.2.6	104.20.23.46
Oct 20, 2024 01:27:05.838012934 CEST	49719	443	192.168.2.6	104.20.23.46
Oct 20, 2024 01:27:05.838021994 CEST	443	49719	104.20.23.46	192.168.2.6
Oct 20, 2024 01:27:06.475342989 CEST	443	49719	104.20.23.46	192.168.2.6
Oct 20, 2024 01:27:06.475578070 CEST	49719	443	192.168.2.6	104.20.23.46
Oct 20, 2024 01:27:06.512409925 CEST	49719	443	192.168.2.6	104.20.23.46
Oct 20, 2024 01:27:06.512448072 CEST	443	49719	104.20.23.46	192.168.2.6
Oct 20, 2024 01:27:06.513417959 CEST	443	49719	104.20.23.46	192.168.2.6
Oct 20, 2024 01:27:06.515863895 CEST	49719	443	192.168.2.6	104.20.23.46
Oct 20, 2024 01:27:06.563396931 CEST	443	49719	104.20.23.46	192.168.2.6
Oct 20, 2024 01:27:06.960963011 CEST	443	49719	104.20.23.46	192.168.2.6
Oct 20, 2024 01:27:06.961183071 CEST	443	49719	104.20.23.46	192.168.2.6
Oct 20, 2024 01:27:06.961313009 CEST	49719	443	192.168.2.6	104.20.23.46
Oct 20, 2024 01:27:06.961586952 CEST	49719	443	192.168.2.6	104.20.23.46
Oct 20, 2024 01:27:10.061809063 CEST	3631	49714	185.141.35.22	192.168.2.6
Oct 20, 2024 01:27:10.061898947 CEST	49714	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:10.069181919 CEST	49714	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:10.074006081 CEST	3631	49714	185.141.35.22	192.168.2.6
Oct 20, 2024 01:27:10.082374096 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:10.087244987 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:27:10.087323904 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:10.129725933 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:10.134565115 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:27:20.540927887 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:20.545769930 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:27:28.982532024 CEST	64165	53	192.168.2.6	162.159.36.2
Oct 20, 2024 01:27:28.987500906 CEST	53	64165	162.159.36.2	192.168.2.6
Oct 20, 2024 01:27:28.987602949 CEST	64165	53	192.168.2.6	162.159.36.2
Oct 20, 2024 01:27:28.988343000 CEST	64165	53	192.168.2.6	162.159.36.2
Oct 20, 2024 01:27:28.993407965 CEST	53	64165	162.159.36.2	192.168.2.6
Oct 20, 2024 01:27:29.585525036 CEST	53	64165	162.159.36.2	192.168.2.6
Oct 20, 2024 01:27:29.585908890 CEST	64165	53	192.168.2.6	162.159.36.2
Oct 20, 2024 01:27:29.591176033 CEST	53	64165	162.159.36.2	192.168.2.6
Oct 20, 2024 01:27:29.591276884 CEST	64165	53	192.168.2.6	162.159.36.2
Oct 20, 2024 01:27:30.897030115 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:30.901845932 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:27:41.288568020 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:41.293505907 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:27:51.678231001 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:51.912194967 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:27:52.098114967 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:27:52.098150015 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:02.068830013 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:02.073708057 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:10.084335089 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:10.089231014 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:20.475238085 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:20.480145931 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:22.459479094 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:22.464474916 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:22.474889040 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:22.479732990 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:22.490537882 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:22.495492935 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:22.521819115 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:22.526647091 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:22.537362099 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:22.542226076 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:22.553021908 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:22.557920933 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:22.568739891 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:22.573575020 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:22.584275007 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:22.589209080 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:26.146728039 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:26.151751041 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:27.787777901 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:27.792840958 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:29.365641117 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:29.370642900 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:36.427987099 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:36.432967901 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:40.443612099 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:40.611972094 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:45.568643093 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:45.573672056 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:47.771758080 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:47.776890039 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:48.568579912 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:48.573679924 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:49.225048065 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:49.230541945 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:53.709454060 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:53.714639902 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:28:53.771728039 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:28:53.776721001 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:00.631083965 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:00.635966063 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:03.881068945 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:03.885888100 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:03.928124905 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:03.933052063 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:03.943516970 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:03.950150967 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:07.646689892 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:07.651603937 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:14.443530083 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:14.448425055 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:15.209273100 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:15.214235067 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:25.599965096 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:25.604805946 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:35.993016005 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:35.998188019 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:40.064253092 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:40.064347029 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:42.106575966 CEST	49744	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:42.218363047 CEST	3631	49744	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:42.236756086 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:42.241642952 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:42.241720915 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:42.361891031 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:42.366744041 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:43.381027937 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:43.385854959 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:47.943532944 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:47.948342085 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:29:53.259682894 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:29:53.264597893 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:06.162244081 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:06.167077065 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:14.896518946 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:14.902133942 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:18.115442038 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:18.120371103 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:26.756086111 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:26.760976076 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:34.740437031 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:34.975591898 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:35.303688049 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:35.462415934 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:35.462460995 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:35.462486982 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:40.241024971 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:40.246304989 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:46.568309069 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:46.573292971 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:50.677786112 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:50.682856083 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:30:58.631171942 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:30:58.636037111 CEST	3631	64315	185.141.35.22	192.168.2.6
Oct 20, 2024 01:31:03.441267014 CEST	64315	3631	192.168.2.6	185.141.35.22
Oct 20, 2024 01:31:03.446105957 CEST	3631	64315	185.141.35.22	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 01:26:58.730129957 CEST	61123	53	192.168.2.6	1.1.1.1
Oct 20, 2024 01:26:58.737442970 CEST	53	61123	1.1.1.1	192.168.2.6
Oct 20, 2024 01:27:02.005841970 CEST	64954	53	192.168.2.6	1.1.1.1
Oct 20, 2024 01:27:02.022336960 CEST	53	64954	1.1.1.1	192.168.2.6
Oct 20, 2024 01:27:02.883661032 CEST	57224	53	192.168.2.6	1.1.1.1
Oct 20, 2024 01:27:02.934796095 CEST	53	57224	1.1.1.1	192.168.2.6
Oct 20, 2024 01:27:05.828855038 CEST	56587	53	192.168.2.6	1.1.1.1
Oct 20, 2024 01:27:05.835866928 CEST	53	56587	1.1.1.1	192.168.2.6
Oct 20, 2024 01:27:28.981729031 CEST	53	50348	162.159.36.2	192.168.2.6
Oct 20, 2024 01:27:29.597295046 CEST	52764	53	192.168.2.6	1.1.1.1
Oct 20, 2024 01:27:29.604582071 CEST	53	52764	1.1.1.1	192.168.2.6
Oct 20, 2024 01:29:42.122349977 CEST	54829	53	192.168.2.6	1.1.1.1
Oct 20, 2024 01:29:42.230297089 CEST	53	54829	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 01:26:58.730129957 CEST	192.168.2.6	1.1.1.1	0x3479	Standard query (0)	getsolara.dev	A (IP address)	IN (0x0001)	false
Oct 20, 2024 01:27:02.005841970 CEST	192.168.2.6	1.1.1.1	0xfdbb	Standard query (0)	d8zyctl.localto.net	A (IP address)	IN (0x0001)	false
Oct 20, 2024 01:27:02.883661032 CEST	192.168.2.6	1.1.1.1	0x3090	Standard query (0)	clientsettings.roblox.com	A (IP address)	IN (0x0001)	false
Oct 20, 2024 01:27:05.828855038 CEST	192.168.2.6	1.1.1.1	0x8df3	Standard query (0)	www.nodejs.org	A (IP address)	IN (0x0001)	false
Oct 20, 2024 01:27:29.597295046 CEST	192.168.2.6	1.1.1.1	0xd846	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 20, 2024 01:29:42.122349977 CEST	192.168.2.6	1.1.1.1	0x5727	Standard query (0)	d8zyctl.localto.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 01:26:58.737442970 CEST	1.1.1.1	192.168.2.6	0x3479	No error (0)	getsolara.dev		172.67.203.125	A (IP address)	IN (0x0001)	false
Oct 20, 2024 01:26:58.737442970 CEST	1.1.1.1	192.168.2.6	0x3479	No error (0)	getsolara.dev		104.21.93.27	A (IP address)	IN (0x0001)	false
Oct 20, 2024 01:27:02.022336960 CEST	1.1.1.1	192.168.2.6	0xfdbb	No error (0)	d8zyctl.localto.net		185.141.35.22	A (IP address)	IN (0x0001)	false
Oct 20, 2024 01:27:02.934796095 CEST	1.1.1.1	192.168.2.6	0x3090	No error (0)	clientsettings.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 20, 2024 01:27:02.934796095 CEST	1.1.1.1	192.168.2.6	0x3090	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 20, 2024 01:27:02.934796095 CEST	1.1.1.1	192.168.2.6	0x3090	No error (0)	edge-term4.roblox.com	edge-term4-fra2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 20, 2024 01:27:02.934796095 CEST	1.1.1.1	192.168.2.6	0x3090	No error (0)	edge-term4-fra2.roblox.com		128.116.123.4	A (IP address)	IN (0x0001)	false
Oct 20, 2024 01:27:05.835866928 CEST	1.1.1.1	192.168.2.6	0x8df3	No error (0)	www.nodejs.org		104.20.23.46	A (IP address)	IN (0x0001)	false
Oct 20, 2024 01:27:05.835866928 CEST	1.1.1.1	192.168.2.6	0x8df3	No error (0)	www.nodejs.org		104.20.22.46	A (IP address)	IN (0x0001)	false
Oct 20, 2024 01:27:29.604582071 CEST	1.1.1.1	192.168.2.6	0xd846	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 20, 2024 01:29:42.230297089 CEST	1.1.1.1	192.168.2.6	0x5727	No error (0)	d8zyctl.localto.net		185.141.35.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

getsolara.dev

clientsettings.roblox.com

www.nodejs.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	172.67.203.125	443	7084	C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-19 23:26:59 UTC	81	OUT	GET /asset/discord.json HTTP/1.1 Host: getsolara.dev Connection: Keep-Alive
2024-10-19 23:26:59 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 19 Oct 2024 23:26:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"7d966f73b6ce74a610dddaf0d0951ed8" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iUPzqxGfr1Efysynwou2TykDEsLhSemvwzUW270JzZK1cuaPGt1Tc%2Fw5gwCO1IeKXZvEKijX0emx%2FCWwFkHDWXJEuoQ7K3C2OXAB6rK8z3%2Fep3WYQtEX3%2F5I5h%2FfjygW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8d5489465ae26c68-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1197&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2811&recv_bytes=695&delivery_rate=2343042&cwnd=251&unsent_bytes=0&cid=9d2e59680e8b0fc9&ts=269&x=0"
2024-10-19 23:26:59 UTC	109	IN	Data Raw: 36 37 0d 0a 7b 0a 20 20 20 20 22 61 72 67 73 22 20 3a 20 7b 0a 20 20 20 20 20 20 20 22 63 6f 64 65 22 20 3a 20 22 38 50 67 73 70 52 59 41 51 75 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 63 6d 64 22 20 3a 20 22 49 4e 56 49 54 45 5f 42 52 4f 57 53 45 52 22 2c 0a 20 20 20 20 22 6e 6f 6e 63 65 22 20 3a 20 22 2e 22 0a 20 7d 0d 0a Data Ascii: 67{ "args" : { "code" : "8PgspRYAQu" }, "cmd" : "INVITE_BROWSER", "nonce" : "." }
2024-10-19 23:26:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	172.67.203.125	443	7084	C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-19 23:27:02 UTC	56	OUT	GET /api/endpoint.json HTTP/1.1 Host: getsolara.dev
2024-10-19 23:27:02 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 19 Oct 2024 23:27:02 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"d5b1b21ea841e30137558eeb7f510379" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=joxQEY2uMl25HuETzDxrusIILCZlZPSkE4DsRbFWTdsH6Wx0bnN4goRHH4aX%2BSYTrr4tFoP97tcY1JwNLFExFdYY%2BRHvjzTFiy0ZWc0mMfgsATL9QsIt9lOmPnCXHEXd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8d54895879734870-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1111&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2812&recv_bytes=694&delivery_rate=2441821&cwnd=232&unsent_bytes=0&cid=62d8bc38457a37ef&ts=200&x=0"
2024-10-19 23:27:02 UTC	352	IN	Data Raw: 32 32 65 0d 0a 7b 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 20 22 31 2e 32 32 22 2c 0a 20 20 20 20 22 53 75 70 70 6f 72 74 65 64 43 6c 69 65 6e 74 22 3a 20 22 76 65 72 73 69 6f 6e 2d 39 64 62 66 39 37 38 30 35 36 32 34 34 34 65 31 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 56 65 72 73 69 6f 6e 22 3a 20 22 33 2e 31 32 32 22 2c 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 33 30 30 66 61 36 32 32 2e 73 6f 6c 61 72 61 77 65 62 2d 61 6c 6a 2e 70 61 67 65 73 2e 64 65 76 2f 64 6f 77 6e 6c 6f 61 64 2f 73 74 61 74 69 63 2f 66 69 6c 65 73 2f 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 65 78 65 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 55 72 6c 22 3a 22 68 74 74 70 73 Data Ascii: 22e{ "BootstrapperVersion": "1.22", "SupportedClient": "version-9dbf9780562444e1", "SoftwareVersion": "3.122", "BootstrapperUrl": "https://300fa622.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe", "SoftwareUrl":"https
2024-10-19 23:27:02 UTC	213	IN	Data Raw: 73 3a 2f 2f 63 6c 69 65 6e 74 73 65 74 74 69 6e 67 73 2e 72 6f 62 6c 6f 78 2e 63 6f 6d 2f 76 32 2f 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 2f 57 69 6e 64 6f 77 73 50 6c 61 79 65 72 2f 63 68 61 6e 6e 65 6c 2f 6c 69 76 65 22 2c 0a 20 20 20 20 22 43 6c 69 65 6e 74 48 61 73 68 22 3a 22 30 38 66 39 30 33 66 38 66 61 35 37 37 61 62 30 32 37 64 36 61 39 36 63 32 30 33 62 62 33 39 62 36 61 39 33 64 34 61 63 39 34 62 38 63 39 32 37 31 64 36 32 34 33 33 34 63 33 38 62 33 61 30 33 22 2c 0a 20 20 20 20 22 43 68 61 6e 67 65 6c 6f 67 22 3a 22 5b 2b 5d 20 49 6d 70 72 6f 76 65 64 20 6c 6f 61 64 73 74 72 69 6e 67 20 74 69 6d 65 73 22 0a 7d 0d 0a Data Ascii: s://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live", "ClientHash":"08f903f8fa577ab027d6a96c203bb39b6a93d4ac94b8c9271d624334c38b3a03", "Changelog":"[+] Improved loadstring times"}
2024-10-19 23:27:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49715	128.116.123.4	443	7084	C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-19 23:27:03 UTC	119	OUT	GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1 Host: clientsettings.roblox.com Connection: Keep-Alive
2024-10-19 23:27:04 UTC	576	IN	HTTP/1.1 200 OK content-length: 119 content-type: application/json; charset=utf-8 date: Sat, 19 Oct 2024 23:27:03 GMT server: Kestrel cache-control: no-cache strict-transport-security: max-age=3600 x-frame-options: SAMEORIGIN roblox-machine-id: 4f9d864b-4ba9-9add-98fc-e0517eb6d6ac x-roblox-region: us-central_rbx x-roblox-edge: fra2 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://ncs.roblox.com/upload"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1} connection: close
2024-10-19 23:27:04 UTC	119	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 22 30 2e 36 34 37 2e 30 2e 36 34 37 30 37 31 37 22 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 55 70 6c 6f 61 64 22 3a 22 76 65 72 73 69 6f 6e 2d 39 64 62 66 39 37 38 30 35 36 32 34 34 34 65 31 22 2c 22 62 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 22 31 2c 20 36 2c 20 30 2c 20 36 34 37 30 37 31 37 22 7d Data Ascii: {"version":"0.647.0.6470717","clientVersionUpload":"version-9dbf9780562444e1","bootstrapperVersion":"1, 6, 0, 6470717"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49719	104.20.23.46	443	7084	C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-19 23:27:06 UTC	99	OUT	GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1 Host: www.nodejs.org Connection: Keep-Alive
2024-10-19 23:27:06 UTC	497	IN	HTTP/1.1 307 Temporary Redirect Date: Sat, 19 Oct 2024 23:27:06 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=0, must-revalidate location: https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi strict-transport-security: max-age=31536000; includeSubDomains; preload x-vercel-id: cle1::cs9km-1729380426880-24ed09e564e5 CF-Cache-Status: DYNAMIC X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8d5489722b5b4683-DFW
2024-10-19 23:27:06 UTC	20	IN	Data Raw: 66 0d 0a 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 0a 0d 0a Data Ascii: fRedirecting...
2024-10-19 23:27:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	19:26:56
Start date:	19/10/2024
Path:	C:\Users\user\Desktop\oIDX88LpSs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\oIDX88LpSs.exe"
Imagebase:	0x760000
File size:	1'073'664 bytes
MD5 hash:	14461F84B8FCA58F2A3A6FDC884582FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2113525590.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2113525590.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	19:26:56
Start date:	19/10/2024
Path:	C:\Users\user\AppData\Roaming\MyNigga!.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\MyNigga!.exe"
Imagebase:	0x9b0000
File size:	76'800 bytes
MD5 hash:	2B3B90E6EED13A7E4E2F8285F0022F94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000000.2110723473.00000000009B2000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000000.2110723473.00000000009B2000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\MyNigga!.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\MyNigga!.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	19:26:56
Start date:	19/10/2024
Path:	C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\BootstrapperV1.22.exe"
Imagebase:	0x1bf52100000
File size:	819'200 bytes
MD5 hash:	2A4DCF20B82896BE94EB538260C5FB93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	19:26:56
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	19:26:57
Start date:	19/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c ipconfig /all
Imagebase:	0x7ff7ea9c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	19:26:57
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	19:26:57
Start date:	19/10/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff6d92c0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	8
Start time:	19:27:01
Start date:	19/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FluxusV1" /tr "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff652c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	19:27:01
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	19:27:03
Start date:	19/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff663b20000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	19:27:06
Start date:	19/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7084 -s 2188
Imagebase:	0x7ff6afbf0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	19:27:10
Start date:	19/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff663b20000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	19:27:12
Start date:	19/10/2024
Path:	C:\Windows\System32\SIHClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\sihclient.exe /cv 7NrvztKWqECbt1RuJH7L+Q.0.2
Imagebase:	0x7ff792bb0000
File size:	380'720 bytes
MD5 hash:	8BE47315BF30475EEECE8E39599E9273
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	18
Start time:	19:27:18
Start date:	19/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff663b20000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	19:28:01
Start date:	19/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff663b20000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	19:29:00
Start date:	19/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff663b20000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	19:30:00
Start date:	19/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff663b20000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	19:31:00
Start date:	19/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff663b20000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false