Windows Analysis Report
1L8qjfD9J2.exe

AV Detection

Source: 00000000.00000002.2071740134.0000000002948000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Njrat {"Host": "ronymahmoud.casacam.net", "Port": "5050", "Campaign ID": "NYAN CAT", "Network Seprator": "@!#&^%$", "Registry": "0100398783ec4727"}

Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe

ReversingLabs: Detection: 60%

Source: 1L8qjfD9J2.exe

ReversingLabs: Detection: 60%

Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2958b70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33e024c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33f820c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2958b70.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2950a8c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33f820c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2950a8c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33e024c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2132884068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002958000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.0000000003400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.0000000003351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4489725639.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1L8qjfD9J2.exe PID: 3128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eEUHByXtioQ.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7784, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Source: 1L8qjfD9J2.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49914 version: TLS 1.2

Source:	Binary string: NKXi.pdb source: 1L8qjfD9J2.exe, eEUHByXtioQ.exe.0.dr
Source:	Binary string: NKXi.pdbBSJB source: 1L8qjfD9J2.exe, eEUHByXtioQ.exe.0.dr

Networking

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49709 -> 52.201.248.168:5050
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.5:49709 -> 52.201.248.168:5050
Source: Network traffic	Suricata IDS: 2825565 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity Sending Screenshot (CAP) : 192.168.2.5:49709 -> 52.201.248.168:5050
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49709 -> 52.201.248.168:5050

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 52.201.248.168:5050

Source: Joe Sandbox View

ASN Name: AMAZON-AESUS AMAZON-AESUS

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: ronymahmoud.casacam.net

Source: 1L8qjfD9J2.exe, 00000000.00000002.2071740134.0000000002851000.00000004.00000800.00020000.00000000.sdmp, eEUHByXtioQ.exe, 0000000A.00000002.2103806938.0000000003351000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49914 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: 0.2.1L8qjfD9J2.exe.2950a8c.1.raw.unpack, Keylogger.cs	.Net Code: VKCodeToUnicode
Source: 0.2.1L8qjfD9J2.exe.2958b70.2.raw.unpack, Keylogger.cs	.Net Code: VKCodeToUnicode

E-Banking Fraud

Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2958b70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33e024c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33f820c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2958b70.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2950a8c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33f820c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2950a8c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33e024c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2132884068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002958000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.0000000003400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.0000000003351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4489725639.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1L8qjfD9J2.exe PID: 3128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eEUHByXtioQ.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7784, type: MEMORYSTR

System Summary

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_00BDE0CC		0_2_00BDE0CC
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_00BD4B18		0_2_00BD4B18
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_04D2C4B8		0_2_04D2C4B8
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_04D2E118		0_2_04D2E118
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_04D2E128		0_2_04D2E128
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DA7428		0_2_06DA7428
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DA2398		0_2_06DA2398
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DA9091		0_2_06DA9091
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DA90A0		0_2_06DA90A0
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DA6FF0		0_2_06DA6FF0
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DA6FB5		0_2_06DA6FB5
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DA8C57		0_2_06DA8C57
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DA8C68		0_2_06DA8C68
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DA784F		0_2_06DA784F
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DA7860		0_2_06DA7860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0289F330		9_2_0289F330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_02895DA3		9_2_02895DA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_05EC0040		9_2_05EC0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_05EC8D40		9_2_05EC8D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_05EC8D19		9_2_05EC8D19
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Code function: 10_2_015EE0CC		10_2_015EE0CC
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Code function: 10_2_0596E118		10_2_0596E118
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Code function: 10_2_0596E128		10_2_0596E128

Source: 1L8qjfD9J2.exe, 00000000.00000000.2015410164.0000000000322000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNKXi.exe< vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe, 00000000.00000002.2071740134.0000000002948000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenyaan.exe4 vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe, 00000000.00000002.2068929034.000000000083E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe, 00000000.00000002.2071740134.0000000002A10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBeerPubProject.dll> vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe, 00000000.00000002.2071740134.0000000002960000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenyaan.exe4 vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe, 00000000.00000002.2071740134.000000000296B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBeerPubProject.dll> vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe, 00000000.00000002.2074922981.0000000006AF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe, 00000000.00000002.2072701700.0000000003934000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe, 00000000.00000002.2075253047.00000000072D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe, 00000000.00000002.2074385105.0000000004F60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBeerPubProject.dll> vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe, 00000000.00000002.2071740134.0000000002958000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenyaan.exe4 vs 1L8qjfD9J2.exe
Source: 1L8qjfD9J2.exe	Binary or memory string: OriginalFilenameNKXi.exe< vs 1L8qjfD9J2.exe

Source: 1L8qjfD9J2.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 1L8qjfD9J2.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: eEUHByXtioQ.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, mjQVQDUi6AayujXEMN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, mjQVQDUi6AayujXEMN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, IIAg2pkKirRgFYmRF7.cs	Security API names: _0020.SetAccessControl
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, IIAg2pkKirRgFYmRF7.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, IIAg2pkKirRgFYmRF7.cs	Security API names: _0020.AddAccessRule
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, IIAg2pkKirRgFYmRF7.cs	Security API names: _0020.SetAccessControl
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, IIAg2pkKirRgFYmRF7.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, IIAg2pkKirRgFYmRF7.cs	Security API names: _0020.AddAccessRule
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, mjQVQDUi6AayujXEMN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, IIAg2pkKirRgFYmRF7.cs	Security API names: _0020.SetAccessControl
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, IIAg2pkKirRgFYmRF7.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, IIAg2pkKirRgFYmRF7.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/16@1/1

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

File created: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Mutant created: \Sessions\1\BaseNamedObjects\DcfWCodsmjRxSlHbFIRPXxwnbP
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\0100398783ec4727
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7308:120:WilError_03

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

File created: C:\Users\user\AppData\Local\Temp\tmp8E14.tmp

Jump to behavior

Source: 1L8qjfD9J2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1L8qjfD9J2.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1L8qjfD9J2.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

File read: C:\Users\user\Desktop\1L8qjfD9J2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1L8qjfD9J2.exe "C:\Users\user\Desktop\1L8qjfD9J2.exe"
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\1L8qjfD9J2.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eEUHByXtioQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8E14.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eEUHByXtioQ" /XML "C:\Users\user\AppData\Local\Temp\tmpA1EA.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\1L8qjfD9J2.exe"			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe"			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eEUHByXtioQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8E14.tmp"			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eEUHByXtioQ" /XML "C:\Users\user\AppData\Local\Temp\tmpA1EA.tmp"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: dwrite.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: windowscodecs.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll			Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: avicap32.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvfw32.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: dwrite.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: windowscodecs.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 1L8qjfD9J2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 1L8qjfD9J2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: NKXi.pdb source: 1L8qjfD9J2.exe, eEUHByXtioQ.exe.0.dr
Source:	Binary string: NKXi.pdbBSJB source: 1L8qjfD9J2.exe, eEUHByXtioQ.exe.0.dr

Data Obfuscation

Source: 0.2.1L8qjfD9J2.exe.2950a8c.1.raw.unpack, Program.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 0.2.1L8qjfD9J2.exe.2958b70.2.raw.unpack, Program.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, IIAg2pkKirRgFYmRF7.cs	.Net Code: uD1aOlqSI4 System.Reflection.Assembly.Load(byte[])
Source: 0.2.1L8qjfD9J2.exe.2a00c94.3.raw.unpack, Pub.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.1L8qjfD9J2.exe.2a3b5a0.0.raw.unpack, Pub.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.1L8qjfD9J2.exe.4f60000.6.raw.unpack, Pub.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, IIAg2pkKirRgFYmRF7.cs	.Net Code: uD1aOlqSI4 System.Reflection.Assembly.Load(byte[])
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, IIAg2pkKirRgFYmRF7.cs	.Net Code: uD1aOlqSI4 System.Reflection.Assembly.Load(byte[])
Source: 10.2.eEUHByXtioQ.exe.353b6f0.4.raw.unpack, Pub.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_04D27228 push esp; iretd		0_2_04D27229
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Code function: 0_2_06DAB3E0 push esp; iretd		0_2_06DAB3E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_05EC8078 push eax; iretd		9_2_05EC80A1
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Code function: 10_2_05967228 push esp; iretd		10_2_05967229

Source: 1L8qjfD9J2.exe	Static PE information: section name: .text entropy: 7.735668767994511
Source: eEUHByXtioQ.exe.0.dr	Static PE information: section name: .text entropy: 7.735668767994511

Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, s7h99TrUWb9ws5QiEW.cs	High entropy of concatenated method names: 'XRAbnevUIk', 'YnIb5KkIMn', 'c12bUt6bNI', 'LWRbrqMeDO', 'NC9bLJOBEF', 'tlhbx9p3Ad', 'WtybZD7sC8', 'Gtpbjkr39U', 'JkFbTC6nad', 'OCnb2GSJcS'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, Vh8pPYmwNlHbV3gDkN.cs	High entropy of concatenated method names: 'KsEZtTdgeQ', 'uOGZVBBuM3', 'qHgjErafnA', 'CcKjCFeK6L', 'pvUZexXerm', 'QqqZ4mAag8', 'romZ9ktJXP', 'xpfZBEAIAb', 's59ZSj3g5W', 'KEOZFNhZQW'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, YQ2CN3FWrbrJTKkayX.cs	High entropy of concatenated method names: 'ToString', 'i9kxe7QPfB', 'jQwxRLQ1Hc', 'bG1xv6qoad', 'uTdx1iAd71', 'HcXxoE30bp', 'v1Ox0fWNM1', 'tlSxsvxVSD', 'ByDxwwbAWy', 'oTlxgq1wOx'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, Pd01tHfAte50C64RK7.cs	High entropy of concatenated method names: 'K5WAimSWkq', 'a31AHD0Bvj', 'SmZANuFhm1', 'f8lAuQf3wW', 'N7AAk7Umwv', 'AwPN6UuSrZ', 'y3iNmew2EU', 'paANMp3g1W', 'HsLNtBqE44', 'SVNNQxLDNh'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, rRDiv0HEkbBoTbCjOM.cs	High entropy of concatenated method names: 'Dispose', 'STkCQVHEea', 'sJXXRf1jpY', 'K91yY04Uox', 'ffdCV6yNtb', 'zp9CzqipH6', 'ProcessDialogKey', 'cqXXEAaluN', 'DwgXCC91OY', 'mDvXXtU2wO'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, ViPd4OzmNkQb1NRft3.cs	High entropy of concatenated method names: 'Rxy25VJEKd', 'Qrg2U3IXy1', 'cA52reT6uY', 'EY22fZMoiT', 'iRV2RfERy5', 'dBF21hDO6q', 'g4e2oxbB02', 'rKv2l4XAbU', 'RQI2PQP4mH', 'r3f2c4aJKA'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, RLxbwYgqwMf06PBUWH.cs	High entropy of concatenated method names: 'SyquPjtw5f', 'VrtucaTvhE', 'b4puOLoIHa', 'ovxunCQRMY', 'uG3uywLhjg', 'u2Au5JZmaw', 'p9RuIqMcFQ', 'A1guUn4x14', 'L7surCcQjC', 'KytuhSA8Vh'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, JcnwEyCCEGaWXjnjarU.cs	High entropy of concatenated method names: 'Cgu2VlF7m8', 'Nq82zGQy5e', 'aBHJEPEqm5', 'qC7JCW1aee', 'ghxJX4DbPp', 'WJWJp1ftL9', 'lZfJaWcb83', 'vCjJifGcOG', 't7cJGo0kjv', 'ycdJHcMcpv'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, mjQVQDUi6AayujXEMN.cs	High entropy of concatenated method names: 'FESHBdfsrg', 'dU4HSJjusR', 'CPwHFr9Tg6', 'u9PHq4RTQd', 'CUQH64p6Ew', 'SkCHmfY820', 'A3GHMIFh8b', 'kMUHtI5QIb', 'nQkHQxdFx3', 'GIrHV91Txw'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, cAaluNQIwgC91OY3Dv.cs	High entropy of concatenated method names: 'NChTfLhTfm', 'VPnTR9qbc3', 'LWSTvD0n9f', 'HVCT1JsiWa', 'xU1TocSPuT', 'apeT0KEYiT', 'v5iTsxCq3t', 'MUdTwVUGWy', 'nbhTgKnxWd', 'mvSTdscTX4'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, WU2wOfVi7pd4Qc5MkE.cs	High entropy of concatenated method names: 'AWU2b6xtMA', 'Wvd2NjV9en', 'RsD2AZ0pti', 'HCr2uc2sgZ', 'wqa2TGEaD9', 'cyx2k4ladf', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, eWIrHlCavjsdnvXkNJQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'O4JYT4cfe4', 'lNMY25uCvR', 'QeOYJ0EdGU', 'fviYYRiLZ6', 'arPY7c8u3B', 'MlNYWMW5Lb', 'joMYlWkoew'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, WlTAfcangwf6HSyrX4.cs	High entropy of concatenated method names: 'fj8CujQVQD', 'e6ACkayujX', 'sUWC8b9ws5', 'XiEC3WR0a0', 'LssCL869d0', 'ItHCxAte50', 'DkBBTinmqb4ABYMtuA', 'ermThaHEgQ2J5n6UZn', 'uiICCvb0Qi', 'mWmCp8XOdt'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, s5VaL1X4xLqvPMveDx.cs	High entropy of concatenated method names: 'rHbOrC24a', 'Uj0nvnjOL', 'Mbq5HMXWI', 'l7JImCDkG', 'NdHrppBNq', 'A1ph38dRV', 'ivTsAaT1vGacpvtmq5', 'fxdbNA7wjwudf04N8V', 'uqHjEJJfE', 'WRL2ji0uc'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, IIAg2pkKirRgFYmRF7.cs	High entropy of concatenated method names: 'QYOpiI5jML', 'bMPpGSnBQr', 'zcwpHAubuS', 'sPipbM3MHB', 'oo3pNQmEFL', 'mSTpAXDq4j', 'vPGpuhusvq', 'AOvpk7HXo6', 'gyppKfUSu4', 'u7Hp8rPEI7'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, oK7t4x9r9Fatg14l7x.cs	High entropy of concatenated method names: 'T5dDUy5xvr', 'gTSDrgHu0D', 'B69DfnldEF', 'EgjDRC6CDF', 'RHSD1KtT5N', 'INtDooMyi1', 'QPxDsrJhEn', 'OThDwumSHk', 'aMBDdRcLme', 'kIJDedDZX9'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, H4VHm7CE21R7XaqxQLW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EiR2exCEMp', 'zBC243R8Ji', 'bp829tCedN', 'ch52Bwvgue', 'yNb2Sxvh7o', 'JSK2FOZJAj', 'l6Y2qOOs5E'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, dRS0JcBhnm8IDBYDM5.cs	High entropy of concatenated method names: 'athLdQI2j3', 'MaBL4sc5oU', 'RCxLBb58mX', 'IXlLSlswAo', 'Cc4LRlqVlM', 'ooXLvRrJ4S', 'iJSL1fwJ4B', 'Pf7LoAFFAA', 'VdYL0k7oBi', 'WtQLs9Y0x0'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, RqChJMbMPLVPFpgTVI.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'B4TXQNXocl', 'VM6XV9vkAc', 'BCXXzsSrsN', 'tqnpEfMcLP', 'VYspCuo4dS', 'b8opXn7DkW', 'ovyppOSiZO', 'lclZrWIoY9DP0msnxW0'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, sXd7AusUvnkO0qyo9v.cs	High entropy of concatenated method names: 'BqauG0JC8C', 'H9ZubPFgj7', 'w4HuAaE7Xo', 'vodAVwqW6Z', 'uyOAzDmI6F', 'QWWuEgKMXU', 'RbouCXYmq1', 'BdcuXTWpFL', 'WDDupB30WT', 'ts6uaHF5je'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, oOdxPjCpMscxM7ml8Qi.cs	High entropy of concatenated method names: 'hmIJVZspvK', 'SvmJzuYHcW', 'kK7YEoH5eb', 'R8R1NHO5gcpMsaZRYAp', 'wf8n1kO23i7AbNDXUS0', 'oEGNGtOxP6CwJxID4xT'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, nA6WeLMVnSTkVHEeaG.cs	High entropy of concatenated method names: 'MakTLryXZ7', 'IWTTZ2LEfk', 'O6bTTBmL4D', 'SdFTJO2ZdG', 'UMkT7UCxme', 'u6aTlxVXNa', 'Dispose', 'ILrjG0IJdR', 'C6HjHYwAsb', 'VtCjbfj4Mo'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, YuEH9qqS9UUSv4JMBn.cs	High entropy of concatenated method names: 'e2CZ868Rvo', 'TwWZ3reHGv', 'ToString', 'okXZGOrFkY', 'dkYZHL5PBS', 'wLIZby8app', 'hFjZNth6Qg', 'qJFZAmKI9r', 'sZlZuZPbMC', 'RZGZkTtp2u'
Source: 0.2.1L8qjfD9J2.exe.72d0000.7.raw.unpack, G0a0Mihs0Y23Ssss86.cs	High entropy of concatenated method names: 'SxDNy5VbbN', 'loBNIV41iM', 'Efqbv9ejXv', 'PO6b121bEf', 'hYeboJYahL', 'Cisb0Tuowe', 'qgObsl7sJD', 'zOYbwmYhTD', 'KOBbg9d7iV', 'owubdPhdvo'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, s7h99TrUWb9ws5QiEW.cs	High entropy of concatenated method names: 'XRAbnevUIk', 'YnIb5KkIMn', 'c12bUt6bNI', 'LWRbrqMeDO', 'NC9bLJOBEF', 'tlhbx9p3Ad', 'WtybZD7sC8', 'Gtpbjkr39U', 'JkFbTC6nad', 'OCnb2GSJcS'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, Vh8pPYmwNlHbV3gDkN.cs	High entropy of concatenated method names: 'KsEZtTdgeQ', 'uOGZVBBuM3', 'qHgjErafnA', 'CcKjCFeK6L', 'pvUZexXerm', 'QqqZ4mAag8', 'romZ9ktJXP', 'xpfZBEAIAb', 's59ZSj3g5W', 'KEOZFNhZQW'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, YQ2CN3FWrbrJTKkayX.cs	High entropy of concatenated method names: 'ToString', 'i9kxe7QPfB', 'jQwxRLQ1Hc', 'bG1xv6qoad', 'uTdx1iAd71', 'HcXxoE30bp', 'v1Ox0fWNM1', 'tlSxsvxVSD', 'ByDxwwbAWy', 'oTlxgq1wOx'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, Pd01tHfAte50C64RK7.cs	High entropy of concatenated method names: 'K5WAimSWkq', 'a31AHD0Bvj', 'SmZANuFhm1', 'f8lAuQf3wW', 'N7AAk7Umwv', 'AwPN6UuSrZ', 'y3iNmew2EU', 'paANMp3g1W', 'HsLNtBqE44', 'SVNNQxLDNh'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, rRDiv0HEkbBoTbCjOM.cs	High entropy of concatenated method names: 'Dispose', 'STkCQVHEea', 'sJXXRf1jpY', 'K91yY04Uox', 'ffdCV6yNtb', 'zp9CzqipH6', 'ProcessDialogKey', 'cqXXEAaluN', 'DwgXCC91OY', 'mDvXXtU2wO'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, ViPd4OzmNkQb1NRft3.cs	High entropy of concatenated method names: 'Rxy25VJEKd', 'Qrg2U3IXy1', 'cA52reT6uY', 'EY22fZMoiT', 'iRV2RfERy5', 'dBF21hDO6q', 'g4e2oxbB02', 'rKv2l4XAbU', 'RQI2PQP4mH', 'r3f2c4aJKA'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, RLxbwYgqwMf06PBUWH.cs	High entropy of concatenated method names: 'SyquPjtw5f', 'VrtucaTvhE', 'b4puOLoIHa', 'ovxunCQRMY', 'uG3uywLhjg', 'u2Au5JZmaw', 'p9RuIqMcFQ', 'A1guUn4x14', 'L7surCcQjC', 'KytuhSA8Vh'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, JcnwEyCCEGaWXjnjarU.cs	High entropy of concatenated method names: 'Cgu2VlF7m8', 'Nq82zGQy5e', 'aBHJEPEqm5', 'qC7JCW1aee', 'ghxJX4DbPp', 'WJWJp1ftL9', 'lZfJaWcb83', 'vCjJifGcOG', 't7cJGo0kjv', 'ycdJHcMcpv'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, mjQVQDUi6AayujXEMN.cs	High entropy of concatenated method names: 'FESHBdfsrg', 'dU4HSJjusR', 'CPwHFr9Tg6', 'u9PHq4RTQd', 'CUQH64p6Ew', 'SkCHmfY820', 'A3GHMIFh8b', 'kMUHtI5QIb', 'nQkHQxdFx3', 'GIrHV91Txw'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, cAaluNQIwgC91OY3Dv.cs	High entropy of concatenated method names: 'NChTfLhTfm', 'VPnTR9qbc3', 'LWSTvD0n9f', 'HVCT1JsiWa', 'xU1TocSPuT', 'apeT0KEYiT', 'v5iTsxCq3t', 'MUdTwVUGWy', 'nbhTgKnxWd', 'mvSTdscTX4'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, WU2wOfVi7pd4Qc5MkE.cs	High entropy of concatenated method names: 'AWU2b6xtMA', 'Wvd2NjV9en', 'RsD2AZ0pti', 'HCr2uc2sgZ', 'wqa2TGEaD9', 'cyx2k4ladf', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, eWIrHlCavjsdnvXkNJQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'O4JYT4cfe4', 'lNMY25uCvR', 'QeOYJ0EdGU', 'fviYYRiLZ6', 'arPY7c8u3B', 'MlNYWMW5Lb', 'joMYlWkoew'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, WlTAfcangwf6HSyrX4.cs	High entropy of concatenated method names: 'fj8CujQVQD', 'e6ACkayujX', 'sUWC8b9ws5', 'XiEC3WR0a0', 'LssCL869d0', 'ItHCxAte50', 'DkBBTinmqb4ABYMtuA', 'ermThaHEgQ2J5n6UZn', 'uiICCvb0Qi', 'mWmCp8XOdt'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, s5VaL1X4xLqvPMveDx.cs	High entropy of concatenated method names: 'rHbOrC24a', 'Uj0nvnjOL', 'Mbq5HMXWI', 'l7JImCDkG', 'NdHrppBNq', 'A1ph38dRV', 'ivTsAaT1vGacpvtmq5', 'fxdbNA7wjwudf04N8V', 'uqHjEJJfE', 'WRL2ji0uc'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, IIAg2pkKirRgFYmRF7.cs	High entropy of concatenated method names: 'QYOpiI5jML', 'bMPpGSnBQr', 'zcwpHAubuS', 'sPipbM3MHB', 'oo3pNQmEFL', 'mSTpAXDq4j', 'vPGpuhusvq', 'AOvpk7HXo6', 'gyppKfUSu4', 'u7Hp8rPEI7'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, oK7t4x9r9Fatg14l7x.cs	High entropy of concatenated method names: 'T5dDUy5xvr', 'gTSDrgHu0D', 'B69DfnldEF', 'EgjDRC6CDF', 'RHSD1KtT5N', 'INtDooMyi1', 'QPxDsrJhEn', 'OThDwumSHk', 'aMBDdRcLme', 'kIJDedDZX9'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, H4VHm7CE21R7XaqxQLW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EiR2exCEMp', 'zBC243R8Ji', 'bp829tCedN', 'ch52Bwvgue', 'yNb2Sxvh7o', 'JSK2FOZJAj', 'l6Y2qOOs5E'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, dRS0JcBhnm8IDBYDM5.cs	High entropy of concatenated method names: 'athLdQI2j3', 'MaBL4sc5oU', 'RCxLBb58mX', 'IXlLSlswAo', 'Cc4LRlqVlM', 'ooXLvRrJ4S', 'iJSL1fwJ4B', 'Pf7LoAFFAA', 'VdYL0k7oBi', 'WtQLs9Y0x0'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, RqChJMbMPLVPFpgTVI.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'B4TXQNXocl', 'VM6XV9vkAc', 'BCXXzsSrsN', 'tqnpEfMcLP', 'VYspCuo4dS', 'b8opXn7DkW', 'ovyppOSiZO', 'lclZrWIoY9DP0msnxW0'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, sXd7AusUvnkO0qyo9v.cs	High entropy of concatenated method names: 'BqauG0JC8C', 'H9ZubPFgj7', 'w4HuAaE7Xo', 'vodAVwqW6Z', 'uyOAzDmI6F', 'QWWuEgKMXU', 'RbouCXYmq1', 'BdcuXTWpFL', 'WDDupB30WT', 'ts6uaHF5je'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, oOdxPjCpMscxM7ml8Qi.cs	High entropy of concatenated method names: 'hmIJVZspvK', 'SvmJzuYHcW', 'kK7YEoH5eb', 'R8R1NHO5gcpMsaZRYAp', 'wf8n1kO23i7AbNDXUS0', 'oEGNGtOxP6CwJxID4xT'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, nA6WeLMVnSTkVHEeaG.cs	High entropy of concatenated method names: 'MakTLryXZ7', 'IWTTZ2LEfk', 'O6bTTBmL4D', 'SdFTJO2ZdG', 'UMkT7UCxme', 'u6aTlxVXNa', 'Dispose', 'ILrjG0IJdR', 'C6HjHYwAsb', 'VtCjbfj4Mo'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, YuEH9qqS9UUSv4JMBn.cs	High entropy of concatenated method names: 'e2CZ868Rvo', 'TwWZ3reHGv', 'ToString', 'okXZGOrFkY', 'dkYZHL5PBS', 'wLIZby8app', 'hFjZNth6Qg', 'qJFZAmKI9r', 'sZlZuZPbMC', 'RZGZkTtp2u'
Source: 0.2.1L8qjfD9J2.exe.39baab0.4.raw.unpack, G0a0Mihs0Y23Ssss86.cs	High entropy of concatenated method names: 'SxDNy5VbbN', 'loBNIV41iM', 'Efqbv9ejXv', 'PO6b121bEf', 'hYeboJYahL', 'Cisb0Tuowe', 'qgObsl7sJD', 'zOYbwmYhTD', 'KOBbg9d7iV', 'owubdPhdvo'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, s7h99TrUWb9ws5QiEW.cs	High entropy of concatenated method names: 'XRAbnevUIk', 'YnIb5KkIMn', 'c12bUt6bNI', 'LWRbrqMeDO', 'NC9bLJOBEF', 'tlhbx9p3Ad', 'WtybZD7sC8', 'Gtpbjkr39U', 'JkFbTC6nad', 'OCnb2GSJcS'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, Vh8pPYmwNlHbV3gDkN.cs	High entropy of concatenated method names: 'KsEZtTdgeQ', 'uOGZVBBuM3', 'qHgjErafnA', 'CcKjCFeK6L', 'pvUZexXerm', 'QqqZ4mAag8', 'romZ9ktJXP', 'xpfZBEAIAb', 's59ZSj3g5W', 'KEOZFNhZQW'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, YQ2CN3FWrbrJTKkayX.cs	High entropy of concatenated method names: 'ToString', 'i9kxe7QPfB', 'jQwxRLQ1Hc', 'bG1xv6qoad', 'uTdx1iAd71', 'HcXxoE30bp', 'v1Ox0fWNM1', 'tlSxsvxVSD', 'ByDxwwbAWy', 'oTlxgq1wOx'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, Pd01tHfAte50C64RK7.cs	High entropy of concatenated method names: 'K5WAimSWkq', 'a31AHD0Bvj', 'SmZANuFhm1', 'f8lAuQf3wW', 'N7AAk7Umwv', 'AwPN6UuSrZ', 'y3iNmew2EU', 'paANMp3g1W', 'HsLNtBqE44', 'SVNNQxLDNh'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, rRDiv0HEkbBoTbCjOM.cs	High entropy of concatenated method names: 'Dispose', 'STkCQVHEea', 'sJXXRf1jpY', 'K91yY04Uox', 'ffdCV6yNtb', 'zp9CzqipH6', 'ProcessDialogKey', 'cqXXEAaluN', 'DwgXCC91OY', 'mDvXXtU2wO'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, ViPd4OzmNkQb1NRft3.cs	High entropy of concatenated method names: 'Rxy25VJEKd', 'Qrg2U3IXy1', 'cA52reT6uY', 'EY22fZMoiT', 'iRV2RfERy5', 'dBF21hDO6q', 'g4e2oxbB02', 'rKv2l4XAbU', 'RQI2PQP4mH', 'r3f2c4aJKA'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, RLxbwYgqwMf06PBUWH.cs	High entropy of concatenated method names: 'SyquPjtw5f', 'VrtucaTvhE', 'b4puOLoIHa', 'ovxunCQRMY', 'uG3uywLhjg', 'u2Au5JZmaw', 'p9RuIqMcFQ', 'A1guUn4x14', 'L7surCcQjC', 'KytuhSA8Vh'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, JcnwEyCCEGaWXjnjarU.cs	High entropy of concatenated method names: 'Cgu2VlF7m8', 'Nq82zGQy5e', 'aBHJEPEqm5', 'qC7JCW1aee', 'ghxJX4DbPp', 'WJWJp1ftL9', 'lZfJaWcb83', 'vCjJifGcOG', 't7cJGo0kjv', 'ycdJHcMcpv'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, mjQVQDUi6AayujXEMN.cs	High entropy of concatenated method names: 'FESHBdfsrg', 'dU4HSJjusR', 'CPwHFr9Tg6', 'u9PHq4RTQd', 'CUQH64p6Ew', 'SkCHmfY820', 'A3GHMIFh8b', 'kMUHtI5QIb', 'nQkHQxdFx3', 'GIrHV91Txw'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, cAaluNQIwgC91OY3Dv.cs	High entropy of concatenated method names: 'NChTfLhTfm', 'VPnTR9qbc3', 'LWSTvD0n9f', 'HVCT1JsiWa', 'xU1TocSPuT', 'apeT0KEYiT', 'v5iTsxCq3t', 'MUdTwVUGWy', 'nbhTgKnxWd', 'mvSTdscTX4'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, WU2wOfVi7pd4Qc5MkE.cs	High entropy of concatenated method names: 'AWU2b6xtMA', 'Wvd2NjV9en', 'RsD2AZ0pti', 'HCr2uc2sgZ', 'wqa2TGEaD9', 'cyx2k4ladf', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, eWIrHlCavjsdnvXkNJQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'O4JYT4cfe4', 'lNMY25uCvR', 'QeOYJ0EdGU', 'fviYYRiLZ6', 'arPY7c8u3B', 'MlNYWMW5Lb', 'joMYlWkoew'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, WlTAfcangwf6HSyrX4.cs	High entropy of concatenated method names: 'fj8CujQVQD', 'e6ACkayujX', 'sUWC8b9ws5', 'XiEC3WR0a0', 'LssCL869d0', 'ItHCxAte50', 'DkBBTinmqb4ABYMtuA', 'ermThaHEgQ2J5n6UZn', 'uiICCvb0Qi', 'mWmCp8XOdt'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, s5VaL1X4xLqvPMveDx.cs	High entropy of concatenated method names: 'rHbOrC24a', 'Uj0nvnjOL', 'Mbq5HMXWI', 'l7JImCDkG', 'NdHrppBNq', 'A1ph38dRV', 'ivTsAaT1vGacpvtmq5', 'fxdbNA7wjwudf04N8V', 'uqHjEJJfE', 'WRL2ji0uc'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, IIAg2pkKirRgFYmRF7.cs	High entropy of concatenated method names: 'QYOpiI5jML', 'bMPpGSnBQr', 'zcwpHAubuS', 'sPipbM3MHB', 'oo3pNQmEFL', 'mSTpAXDq4j', 'vPGpuhusvq', 'AOvpk7HXo6', 'gyppKfUSu4', 'u7Hp8rPEI7'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, oK7t4x9r9Fatg14l7x.cs	High entropy of concatenated method names: 'T5dDUy5xvr', 'gTSDrgHu0D', 'B69DfnldEF', 'EgjDRC6CDF', 'RHSD1KtT5N', 'INtDooMyi1', 'QPxDsrJhEn', 'OThDwumSHk', 'aMBDdRcLme', 'kIJDedDZX9'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, H4VHm7CE21R7XaqxQLW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EiR2exCEMp', 'zBC243R8Ji', 'bp829tCedN', 'ch52Bwvgue', 'yNb2Sxvh7o', 'JSK2FOZJAj', 'l6Y2qOOs5E'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, dRS0JcBhnm8IDBYDM5.cs	High entropy of concatenated method names: 'athLdQI2j3', 'MaBL4sc5oU', 'RCxLBb58mX', 'IXlLSlswAo', 'Cc4LRlqVlM', 'ooXLvRrJ4S', 'iJSL1fwJ4B', 'Pf7LoAFFAA', 'VdYL0k7oBi', 'WtQLs9Y0x0'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, RqChJMbMPLVPFpgTVI.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'B4TXQNXocl', 'VM6XV9vkAc', 'BCXXzsSrsN', 'tqnpEfMcLP', 'VYspCuo4dS', 'b8opXn7DkW', 'ovyppOSiZO', 'lclZrWIoY9DP0msnxW0'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, sXd7AusUvnkO0qyo9v.cs	High entropy of concatenated method names: 'BqauG0JC8C', 'H9ZubPFgj7', 'w4HuAaE7Xo', 'vodAVwqW6Z', 'uyOAzDmI6F', 'QWWuEgKMXU', 'RbouCXYmq1', 'BdcuXTWpFL', 'WDDupB30WT', 'ts6uaHF5je'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, oOdxPjCpMscxM7ml8Qi.cs	High entropy of concatenated method names: 'hmIJVZspvK', 'SvmJzuYHcW', 'kK7YEoH5eb', 'R8R1NHO5gcpMsaZRYAp', 'wf8n1kO23i7AbNDXUS0', 'oEGNGtOxP6CwJxID4xT'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, nA6WeLMVnSTkVHEeaG.cs	High entropy of concatenated method names: 'MakTLryXZ7', 'IWTTZ2LEfk', 'O6bTTBmL4D', 'SdFTJO2ZdG', 'UMkT7UCxme', 'u6aTlxVXNa', 'Dispose', 'ILrjG0IJdR', 'C6HjHYwAsb', 'VtCjbfj4Mo'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, YuEH9qqS9UUSv4JMBn.cs	High entropy of concatenated method names: 'e2CZ868Rvo', 'TwWZ3reHGv', 'ToString', 'okXZGOrFkY', 'dkYZHL5PBS', 'wLIZby8app', 'hFjZNth6Qg', 'qJFZAmKI9r', 'sZlZuZPbMC', 'RZGZkTtp2u'
Source: 0.2.1L8qjfD9J2.exe.3a06cd0.5.raw.unpack, G0a0Mihs0Y23Ssss86.cs	High entropy of concatenated method names: 'SxDNy5VbbN', 'loBNIV41iM', 'Efqbv9ejXv', 'PO6b121bEf', 'hYeboJYahL', 'Cisb0Tuowe', 'qgObsl7sJD', 'zOYbwmYhTD', 'KOBbg9d7iV', 'owubdPhdvo'

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

File created: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eEUHByXtioQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8E14.tmp"

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: Yara match

File source: Process Memory Space: 1L8qjfD9J2.exe PID: 3128, type: MEMORYSTR

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory allocated: BD0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory allocated: 2850000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory allocated: 2700000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory allocated: 7460000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory allocated: 8460000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory allocated: 8600000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory allocated: 9600000 memory reserve | memory write watch			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: E90000 memory reserve | memory write watch			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 29D0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 27F0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Memory allocated: 15B0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Memory allocated: 3350000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Memory allocated: 3160000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Memory allocated: 7BB0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Memory allocated: 8BB0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Memory allocated: 8D40000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Memory allocated: 9D40000 memory reserve | memory write watch			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 17D0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 32D0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 3220000 memory reserve | memory write watch

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7461			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 854			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7806			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 892			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 940			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 3861			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 4277			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: foregroundWindowGot 1762			Jump to behavior

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe TID: 5752	Thread sleep time: -119380s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe TID: 5752	Thread sleep time: -32009s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe TID: 5752	Thread sleep time: -35000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe TID: 5876	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7516	Thread sleep time: -5534023222112862s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7456	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7520	Thread sleep time: -4611686018427385s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7484	Thread sleep time: -940000s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7484	Thread sleep time: -4277000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe TID: 7528	Thread sleep time: -119380s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe TID: 7528	Thread sleep time: -32009s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe TID: 7528	Thread sleep time: -35000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe TID: 7556	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7812	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Thread delayed: delay time: 119380			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Thread delayed: delay time: 32009			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Thread delayed: delay time: 35000			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Thread delayed: delay time: 119380			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Thread delayed: delay time: 32009			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Thread delayed: delay time: 35000			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: MSBuild.exe, 00000009.00000002.4494287987.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: 0.2.1L8qjfD9J2.exe.2950a8c.1.raw.unpack, Program.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, cbName, ref lpszVer, 100)
Source: 0.2.1L8qjfD9J2.exe.2950a8c.1.raw.unpack, Keylogger.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: 0.2.1L8qjfD9J2.exe.2950a8c.1.raw.unpack, Keylogger.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\1L8qjfD9J2.exe"
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe"
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\1L8qjfD9J2.exe"			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe"			Jump to behavior

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 408000			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 40A000			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 907008			Jump to behavior

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\1L8qjfD9J2.exe"			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe"			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eEUHByXtioQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8E14.tmp"			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eEUHByXtioQ" /XML "C:\Users\user\AppData\Local\Temp\tmpA1EA.tmp"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: MSBuild.exe, 00000009.00000002.4489725639.0000000002F4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.4489725639.0000000002BA3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.4489725639.00000000029D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]q
Source: MSBuild.exe, 00000009.00000002.4494287987.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managere
Source: MSBuild.exe, 00000009.00000002.4494287987.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerC
Source: MSBuild.exe, 00000009.00000002.4494287987.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.4489725639.0000000002F4D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.4489725639.0000000002BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: MSBuild.exe, 00000009.00000002.4494287987.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerv
Source: MSBuild.exe, 00000009.00000002.4494287987.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr
Source: MSBuild.exe, 00000009.00000002.4494287987.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager_
Source: MSBuild.exe, 00000009.00000002.4494287987.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerT[N
Source: MSBuild.exe, 00000009.00000002.4494287987.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerOWN

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Queries volume information: C:\Users\user\Desktop\1L8qjfD9J2.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\1L8qjfD9J2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\Desktop\1L8qjfD9J2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2958b70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33e024c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33f820c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2958b70.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2950a8c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33f820c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2950a8c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33e024c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2132884068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002958000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.0000000003400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.0000000003351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4489725639.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1L8qjfD9J2.exe PID: 3128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eEUHByXtioQ.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7784, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2958b70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33e024c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33f820c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2958b70.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2950a8c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33f820c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1L8qjfD9J2.exe.2950a8c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eEUHByXtioQ.exe.33e024c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2132884068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071740134.0000000002958000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.0000000003400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2103806938.0000000003351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4489725639.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1L8qjfD9J2.exe PID: 3128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eEUHByXtioQ.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7784, type: MEMORYSTR