Edit tour

Windows Analysis Report
7KlNbK2xkt.exe

Overview

General Information

Sample name:	7KlNbK2xkt.exe renamed because original name is a hash value
Original sample name:	88005bd682544ea46a7d19be17f034cce2495baeab462956858b0689a8f702da.exe
Analysis ID:	1584309
MD5:	ca9f0f2dda1cb0439275f6d975dabcf4
SHA1:	2a8515d75c6d70f25669623adb0e2d949caff86b
SHA256:	88005bd682544ea46a7d19be17f034cce2495baeab462956858b0689a8f702da
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses a Windows Living Off The Land Binaries (LOL bins)

Classification

Process Tree

System is w10x64

7KlNbK2xkt.exe (PID: 1868 cmdline: "C:\Users\user\Desktop\7KlNbK2xkt.exe" MD5: CA9F0F2DDA1CB0439275F6D975DABCF4)

cmd.exe (PID: 2332 cmdline: /c ipconfig /flushdns MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 2340 cmdline: ipconfig /flushdns MD5: 62F170FB07FDBB79CEB7147101406EB8)

cmd.exe (PID: 3700 cmdline: /c netsh interface ip delete arpcache MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2768 cmdline: netsh interface ip delete arpcache MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 4128 cmdline: /c certutil -URLCache * delete MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

certutil.exe (PID: 5620 cmdline: certutil -URLCache * delete MD5: F17616EC0522FC5633151F7CAA278CAA)

cmd.exe (PID: 7104 cmdline: /c netsh int ip reset MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3404 cmdline: netsh int ip reset MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 6108 cmdline: /c netsh int ipv4 reset MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5904 cmdline: netsh int ipv4 reset MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 4300 cmdline: /c netsh int ipv6 reset MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4040 cmdline: netsh int ipv6 reset MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 4568 cmdline: /c netsh winsock reset MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3344 cmdline: netsh winsock reset MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 4124 cmdline: /c ping -w 250 -n 1 144.217.123.198 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2852 cmdline: ping -w 250 -n 1 144.217.123.198 MD5: 2F46799D79D22AC72C241EC0322B011D)

cmd.exe (PID: 3120 cmdline: /c ping -w 250 -n 1 144.217.123.200 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2740 cmdline: ping -w 250 -n 1 144.217.123.200 MD5: 2F46799D79D22AC72C241EC0322B011D)

cmd.exe (PID: 5616 cmdline: /c ping -w 250 -n 1 144.217.123.202 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4476 cmdline: ping -w 250 -n 1 144.217.123.202 MD5: 2F46799D79D22AC72C241EC0322B011D)

cmd.exe (PID: 3552 cmdline: /c ping -w 250 -n 1 144.217.153.89 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 5316 cmdline: ping -w 250 -n 1 144.217.153.89 MD5: 2F46799D79D22AC72C241EC0322B011D)

cmd.exe (PID: 3772 cmdline: /c ping -w 250 -n 1 144.217.153.92 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2220 cmdline: ping -w 250 -n 1 144.217.153.92 MD5: 2F46799D79D22AC72C241EC0322B011D)

cmd.exe (PID: 6872 cmdline: /c ping -w 250 -n 1 192.95.19.137 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4424 cmdline: ping -w 250 -n 1 192.95.19.137 MD5: 2F46799D79D22AC72C241EC0322B011D)

cmd.exe (PID: 4200 cmdline: /c ping -w 250 -n 1 192.99.98.193 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4152 cmdline: ping -w 250 -n 1 192.99.98.193 MD5: 2F46799D79D22AC72C241EC0322B011D)

cmd.exe (PID: 3608 cmdline: /c ping -w 250 -n 1 192.95.20.7 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4536 cmdline: ping -w 250 -n 1 192.95.20.7 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 7KlNbK2xkt.exe	Virustotal: Detection: 22%			Perma Link
Source: 7KlNbK2xkt.exe	ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: 7KlNbK2xkt.exe

Joe Sandbox ML: detected

Source:	Binary string: E:\Server (QC)\Loader\x64\Release\Loader.pdbd source: 7KlNbK2xkt.exe, 00000000.00000003.1426963576.000001FF96260000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Server (QC)\Loader\x64\Release\Loader.pdb source: 7KlNbK2xkt.exe, 00000000.00000003.1426963576.000001FF96260000.00000004.00001000.00020000.00000000.sdmp

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.198

Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuN
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5a&
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=MIRA-WW-PH7&FrontEn
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=10337LMEM
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.cssLMEM
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.jsLME
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.jsLMEM
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
Source: certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=13164f2a9ee6956f1439

System Summary

PE file contains section with special chars

Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe

File created: C:\Windows\appcompat\Programs\Amcache.hve

Jump to behavior

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe

File deleted: C:\Windows\Prefetch\cadrespri.7db

Jump to behavior

Source: 7KlNbK2xkt.exe

Static PE information: Number of sections : 13 > 10

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -URLCache * delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -URLCache * delete			Jump to behavior

Source: 7KlNbK2xkt.exe	Static PE information: Section: ZLIB complexity 0.9983488943292371
Source: 7KlNbK2xkt.exe	Static PE information: Section: ZLIB complexity 0.9916797551993067
Source: 7KlNbK2xkt.exe	Static PE information: Section: ZLIB complexity 0.9966264204545454
Source: 7KlNbK2xkt.exe	Static PE information: Section: ZLIB complexity 0.9960575810185185
Source: 7KlNbK2xkt.exe	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.evad.winEXE@75/5@0/8

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4536:120:WilError_03

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7KlNbK2xkt.exe	Virustotal: Detection: 22%
Source: 7KlNbK2xkt.exe	ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\7KlNbK2xkt.exe "C:\Users\user\Desktop\7KlNbK2xkt.exe"
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ipconfig /flushdns
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /flushdns
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c netsh interface ip delete arpcache
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh interface ip delete arpcache
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c certutil -URLCache * delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -URLCache * delete
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c netsh int ip reset
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh int ip reset
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c netsh int ipv4 reset
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh int ipv4 reset
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c netsh int ipv6 reset
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh int ipv6 reset
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c netsh winsock reset
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh winsock reset
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 144.217.123.198
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.198
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 144.217.123.200
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.200
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 144.217.123.202
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.202
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 144.217.153.89
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.153.89
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 144.217.153.92
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.153.92
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 192.95.19.137
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.95.19.137
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 192.99.98.193
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.99.98.193
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 192.95.20.7
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.95.20.7
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ipconfig /flushdns	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c netsh interface ip delete arpcache	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c certutil -URLCache * delete	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c netsh int ip reset	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c netsh int ipv4 reset	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c netsh int ipv6 reset	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c netsh winsock reset	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 144.217.123.198	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 144.217.123.200	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 144.217.123.202	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 144.217.153.89	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 192.95.19.137	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 192.99.98.193	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process created: C:\Windows\System32\cmd.exe /c ping -w 250 -n 1 192.95.20.7	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /flushdns	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh interface ip delete arpcache	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -URLCache * delete	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh int ip reset	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh int ipv4 reset	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh int ipv6 reset	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh winsock reset	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.198	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.200	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.202	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.153.89	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.153.92	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.95.19.137	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.99.98.193	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.95.20.7	Jump to behavior

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\System32\certutil.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 7KlNbK2xkt.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 7KlNbK2xkt.exe

Static file information: File size 19278864 > 1048576

Source: 7KlNbK2xkt.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x10d2600

Source:	Binary string: E:\Server (QC)\Loader\x64\Release\Loader.pdbd source: 7KlNbK2xkt.exe, 00000000.00000003.1426963576.000001FF96260000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Server (QC)\Loader\x64\Release\Loader.pdb source: 7KlNbK2xkt.exe, 00000000.00000003.1426963576.000001FF96260000.00000004.00001000.00020000.00000000.sdmp

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name:
Source: 7KlNbK2xkt.exe	Static PE information: section name: .themida
Source: 7KlNbK2xkt.exe	Static PE information: section name: .boot

Source: 7KlNbK2xkt.exe

Static PE information: section name: entropy: 7.9859216384168565

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /flushdns

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TPM\WMI

Jump to behavior

Source: C:\Windows\System32\netsh.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9

Jump to behavior

Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe

Section loaded: OutputDebugStringW count: 650

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.198
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.200
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.202
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.153.89
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.153.92
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.95.19.137
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.99.98.193
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.95.20.7
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.198	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.200	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.202	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.153.89	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.153.92	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.95.19.137	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.99.98.193	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.95.20.7	Jump to behavior

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window / User API: threadDelayed 796	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window / User API: threadDelayed 1508	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window / User API: threadDelayed 768	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window / User API: threadDelayed 683	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window / User API: threadDelayed 353	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window / User API: threadDelayed 974	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window / User API: threadDelayed 1342	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window / User API: threadDelayed 367	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window / User API: threadDelayed 559	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Window / User API: threadDelayed 739	Jump to behavior

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe TID: 2156	Thread sleep time: -122000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe TID: 2332	Thread sleep time: -76500s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtCreateThreadEx: Direct from: 0x7FF6E687A0F7	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtMapViewOfSection: Direct from: 0x7FF6E687C03C	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQueryValueKey: Direct from: 0x7FF6E685F5D9	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtClose: Direct from: 0x7FF6E685F786
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtSetValueKey: Direct from: 0x7FF6E685F589	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtUnmapViewOfSection: Direct from: 0x7FF6E687AB4E	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQuerySystemInformation: Indirect: 0x7FF6E8547D20	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtAllocateVirtualMemory: Direct from: 0x7FFBCB784B5E	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtClose: Direct from: 0x7FF6E687BE46
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtSetValueKey: Direct from: 0x7FF6E685F53E	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtDeviceIoControlFile: Direct from: 0x7FF6E8965EDF	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQueryInformationProcess: Direct from: 0x7FF6E687AE74	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtDeviceIoControlFile: Direct from: 0x7FF6E68CF111	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQuerySystemInformation: Direct from: 0x7FF6E89D1323	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQuerySystemInformation: Direct from: 0x7FFBCB7626A1	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtClose: Direct from: 0x7FF6E89A55A9
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQueryValueKey: Direct from: 0x7FF6E685F6CB	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtDeviceIoControlFile: Direct from: 0x7FF6E68CF08C	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtDeviceIoControlFile: Direct from: 0x7FF6E899A82C	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtClose: Direct from: 0x7FF6E687AAC1
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtMapViewOfSection: Direct from: 0x7FF6E687BE34	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtSetContextThread: Direct from: 0x7FF6E687A3F4	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtCreateMutant: Direct from: 0x7FF6E6888E86	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQueryValueKey: Direct from: 0x7FF6E89B4416	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQueryInformationProcess: Direct from: 0x7FF6E6879FC5	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQueryInformationProcess: Direct from: 0x7FF6E89BD349	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQuerySystemInformation: Direct from: 0x7FF6E6879F2C	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtCreateFile: Direct from: 0x7FF6E687AFC5	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtClose: Direct from: 0x7FF6E685F325
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtCreateThreadEx: Direct from: 0x7FF6E893CDBF	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQueryValueKey: Direct from: 0x7FF6E89AF5F1	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtDeviceIoControlFile: Direct from: 0x7FF6E8997493	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQuerySystemInformation: Direct from: 0x7FF6E687AA9F	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtSetInformationThread: Direct from: 0x7FF6E68897EE	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtSetValueKey: Direct from: 0x7FF6E89CFEB3	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQueryInformationProcess: Indirect: 0x7FF6E857C333	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtUnmapViewOfSection: Direct from: 0x7FF6E687AAAF	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtOpenKeyEx: Direct from: 0x7FF6E899FDDF	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtSetInformationProcess: Direct from: 0x7FF6E6879E93	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtClose: Direct from: 0x7FF6E687C04E
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6E89ADEFE	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtClose: Direct from: 0x7FF6E687A229
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQuerySystemInformation: Direct from: 0x7FF6E684D34E	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQueryValueKey: Direct from: 0x7FF6E685EAF7	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtOpenSection: Direct from: 0x7FF6E685ED7D	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtOpenKeyEx: Direct from: 0x7FF6E685EAB2	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtCreateKey: Direct from: 0x7FF6E685F4EB	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtCreateThreadEx: Direct from: 0x7FF6E895126D	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtOpenKeyEx: Direct from: 0x7FF6E89D7252	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtClose: Direct from: 0x7FF6E8988A18
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtSetInformationThread: Indirect: 0x7FF6E8577101	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtProtectVirtualMemory: Direct from: 0x7FF6E896145F	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtOpenKeyEx: Direct from: 0x7FF6E899B4B3	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtOpenKeyEx: Direct from: 0x7FF6E685F4A5	Jump to behavior
Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	NtQueryInformationProcess: Indirect: 0x7FF6E859FFD3	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /flushdns	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh interface ip delete arpcache	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -URLCache * delete	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh int ip reset	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh int ipv4 reset	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh int ipv6 reset	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh winsock reset	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.198	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.200	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.123.202	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.153.89	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 144.217.153.92	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.95.19.137	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.99.98.193	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -w 250 -n 1 192.95.20.7	Jump to behavior

Source: C:\Users\user\Desktop\7KlNbK2xkt.exe	Queries volume information: C:\Windows\appcompat\Programs\Amcache.hve VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh interface ip delete arpcache

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Windows Service	2 Windows Service	1 Masquerading	OS Credential Dumping	52 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	43 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	43 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	2 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7KlNbK2xkt.exe	23%	Virustotal		Browse
7KlNbK2xkt.exe	24%	ReversingLabs	Win32.Trojan.Generic
7KlNbK2xkt.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg	certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=MIRA-WW-PH7&FrontEn	certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	false	high
https://deff.nelreports.net/api/report?cat=msn	certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat	certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5a&	certutil.exe, 0000000A.00000002.1448028812.0000024F32547000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
144.217.123.198	unknown	Canada	16276	OVHFR	true
192.95.19.137	unknown	Canada	16276	OVHFR	true
192.95.20.7	unknown	Canada	16276	OVHFR	true
144.217.123.200	unknown	Canada	16276	OVHFR	true
144.217.153.92	unknown	Canada	16276	OVHFR	true
144.217.123.202	unknown	Canada	16276	OVHFR	true
192.99.98.193	unknown	Canada	16276	OVHFR	true
144.217.153.89	unknown	Canada	16276	OVHFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584309
Start date and time:	2025-01-05 07:18:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7KlNbK2xkt.exe renamed because original name is a hash value
Original Sample Name:	88005bd682544ea46a7d19be17f034cce2495baeab462956858b0689a8f702da.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@75/5@0/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
01:19:16	API Interceptor	59063x Sleep call for process: 7KlNbK2xkt.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	armv7l.elf	Get hash	malicious	Unknown	Browse	145.239.178.218
	sHCznAai4a.bat	Get hash	malicious	Unknown	Browse	54.39.248.66
	fuckunix.sh4.elf	Get hash	malicious	Mirai	Browse	51.195.5.52
	fuckunix.arm.elf	Get hash	malicious	Mirai	Browse	217.182.72.80
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	8.33.192.100
	1.elf	Get hash	malicious	Unknown	Browse	151.80.39.185
	armv5l.elf	Get hash	malicious	Mirai	Browse	54.39.164.223
	http://www.escudier-sas.fr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	145.239.37.162
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse	54.37.137.114
	file.exe	Get hash	malicious	Xmrig	Browse	51.222.200.133
OVHFR	armv7l.elf	Get hash	malicious	Unknown	Browse	145.239.178.218
	sHCznAai4a.bat	Get hash	malicious	Unknown	Browse	54.39.248.66
	fuckunix.sh4.elf	Get hash	malicious	Mirai	Browse	51.195.5.52
	fuckunix.arm.elf	Get hash	malicious	Mirai	Browse	217.182.72.80
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	8.33.192.100
	1.elf	Get hash	malicious	Unknown	Browse	151.80.39.185
	armv5l.elf	Get hash	malicious	Mirai	Browse	54.39.164.223
	http://www.escudier-sas.fr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	145.239.37.162
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse	54.37.137.114
	file.exe	Get hash	malicious	Xmrig	Browse	51.222.200.133
OVHFR	armv7l.elf	Get hash	malicious	Unknown	Browse	145.239.178.218
	sHCznAai4a.bat	Get hash	malicious	Unknown	Browse	54.39.248.66
	fuckunix.sh4.elf	Get hash	malicious	Mirai	Browse	51.195.5.52
	fuckunix.arm.elf	Get hash	malicious	Mirai	Browse	217.182.72.80
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	8.33.192.100
	1.elf	Get hash	malicious	Unknown	Browse	151.80.39.185
	armv5l.elf	Get hash	malicious	Mirai	Browse	54.39.164.223
	http://www.escudier-sas.fr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	145.239.37.162
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse	54.37.137.114
	file.exe	Get hash	malicious	Xmrig	Browse	51.222.200.133
OVHFR	armv7l.elf	Get hash	malicious	Unknown	Browse	145.239.178.218
	sHCznAai4a.bat	Get hash	malicious	Unknown	Browse	54.39.248.66
	fuckunix.sh4.elf	Get hash	malicious	Mirai	Browse	51.195.5.52
	fuckunix.arm.elf	Get hash	malicious	Mirai	Browse	217.182.72.80
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	8.33.192.100
	1.elf	Get hash	malicious	Unknown	Browse	151.80.39.185
	armv5l.elf	Get hash	malicious	Mirai	Browse	54.39.164.223
	http://www.escudier-sas.fr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	145.239.37.162
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse	54.37.137.114
	file.exe	Get hash	malicious	Xmrig	Browse	51.222.200.133

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Windows\System32\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	107
Entropy (8bit):	4.225046504182161
Encrypted:	false
SSDEEP:	3:lTzWDRtAxFrgyKVzbtRuFrDfTXwadI8ycO7vn:lXERtwrgyKHRuZDTwYZIr
MD5:	21E9B1B59F89DA69F809231748AA0A30
SHA1:	E1C1814AED4AC28956AF1A3FA1C06A1AF7CD4581
SHA-256:	EE7C8ADF2AC455A388B351035D80F2C3814101A1D4F77EE812B6BDF7E749F485
SHA-512:	CE03F2246D58F3FEA2C392864B71CE5364A5EB0893627E4D973B524830FE5FB1726EE0DAA282210D4ED98D7F0CDA3AE95328D00611AB0F82637E1C773699DE42
Malicious:	false
Preview:	..Sucessfully reset the Winsock Catalog...You must restart the computer in order to complete the reset.....

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.960948937447116
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7KlNbK2xkt.exe
File size:	19'278'864 bytes
MD5:	ca9f0f2dda1cb0439275f6d975dabcf4
SHA1:	2a8515d75c6d70f25669623adb0e2d949caff86b
SHA256:	88005bd682544ea46a7d19be17f034cce2495baeab462956858b0689a8f702da
SHA512:	bbe3b713babc260f62a9a138af34f5a8a887f1c5f306e683f6da0cc4184c99664c4c4745ab003fe6a77c70fd2ae2e5ac22d70a2bbef84119ed122c7138df4eb6
SSDEEP:	393216:PHNQZNFJT2niKMO760wbkDthnLgW1N5o7RWWrQ:/NYNFMnsO7UbghL7N5Qo
TLSH:	35173317AA43EC6EC4BA23F91441C6FED727AFC8941A934B54F62C23B1931174E974E8
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........................8.....................a.................................V.....................................7.......7......

File Icon


Icon Hash:	4f0723454d331751

Static PE Info

General

Entrypoint:	0x142284058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x662C0354 [Fri Apr 26 19:41:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e214abd536041e6aeaffeb784cc36e8e

Entrypoint Preview

Instruction
call 00007F5AF06D3617h
inc ecx
push edx
dec ecx
mov edx, esp
inc ecx
push edx
dec ecx
mov esi, dword ptr [edx+10h]
dec ecx
mov edi, dword ptr [edx+20h]
cld
mov dl, 80h
mov al, byte ptr [esi]
dec eax
inc esi
mov byte ptr [edi], al
dec eax
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F5AF06D3499h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F5AF06D3476h
add dl, dl
jne 00007F5AF06D3499h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F5AF06D34F0h
xor eax, eax
add dl, dl
jne 00007F5AF06D3499h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F5AF06D3598h
add dl, dl
jne 00007F5AF06D3499h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F5AF06D3499h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F5AF06D3499h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F5AF06D3499h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
je 00007F5AF06D349Bh
push edi
mov eax, eax
dec eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
dec eax
inc edi
mov ebx, 00000002h
jmp 00007F5AF06D341Ah
mov eax, 00000001h
add dl, dl
jne 00007F5AF06D3499h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F5AF06D3499h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jc 00007F5AF06D3478h
sub eax, ebx
mov ebx, 00000001h
jne 00007F5AF06D34C0h
mov ecx, 00000001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2dd000	0x4d	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2de3ff	0x40c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e0000	0x31048	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x225d438	0x19a70	.themida
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3357000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2df018	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x1d617e	0xf4200	48e811fb50e9e12012d240c5b4070799	False	0.9983488943292371	data	7.9859216384168565	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x1d8000	0xae54a	0x48200	bf0f5653a20bdf39b75bab36b06e340d	False	0.9916797551993067	DOS executable (COM)	7.969669675233345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x287000	0xb2e8	0x1600	ca9d1556954e3ea126d647d9a655932f	False	0.9966264204545454	data	7.842554870568522	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x293000	0x11b80	0xa400	1391de743cccc7d807967591354c4a91	False	0.9473847179878049	OpenPGP Public Key	7.617843471384982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x2a5000	0x31048	0x14400	dacf2a63e7b333f281c49708650aa48e	False	0.9960575810185185	data	7.947284933580225	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x2d7000	0x5fb0	0x1e00	0386ab8dce132257c720198e84ac7432	False	0.9700520833333334	data	7.904430194440622	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.edata	0x2dd000	0x1000	0x200	675245ec27e99b63695a31764fa7e9d1	False	0.140625	data	0.9175056385011345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x2de000	0x1000	0xa00	0959a96c000cc7fc81d2849c50380492	False	0.301171875	data	3.5197836552888675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2df000	0x1000	0x200	d5489c2a156fcd1b2b6e13c33d15b2e5	False	0.0625	data	0.28456851570206254	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e0000	0x31200	0x31200	6f42d2657a44bc56a9aa24ebaf556b81	False	0.3992923027989822	data	5.776369302220804	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x312000	0x1f72000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x2284000	0x10d2600	0x10d2600	d99c5e440f1e7375ffa60d60a3ed372d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x3357000	0x1000	0x10	1d6fd944088922ab12c4d93823813098	False	1.5	GLS_BINARY_LSB_FIRST	2.474601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2e0190	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.47429078014184395
RT_ICON	0x2e0608	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States	0.40942622950819674
RT_ICON	0x2e0fa0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.3592870544090056
RT_ICON	0x2e2058	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.3176348547717842
RT_ICON	0x2e4610	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.30184222957014645
RT_ICON	0x2e8848	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736	English	United States	0.26192236598890944
RT_ICON	0x2edce0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.2697603531637587
RT_ICON	0x2f7198	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.23555246657991247
RT_ICON	0x3079d0	0x95e0	PNG image data, 256 x 256, 8-bit gray+alpha, non-interlaced	English	United States	0.989105504587156
RT_GROUP_ICON	0x310fc0	0x84	data	English	United States	0.75

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
ntdll.dll	RtlCaptureContext
USER32.dll	GetWindowTextW
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegCreateKeyExW
SHELL32.dll	ShellExecuteW
ole32.dll	CoSetProxyBlanket
OLEAUT32.dll	SysFreeString
MSVCP140.dll	?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
gdiplus.dll	GdipCreateBitmapFromHBITMAP
COMCTL32.dll
SHLWAPI.dll	PathFindFileNameW
IPHLPAPI.DLL	GetIfTable2Ex
WS2_32.dll	connect
bcrypt.dll	BCryptGenRandom
VCRUNTIME140.dll	wcsstr
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	signal
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode
api-ms-win-crt-math-l1-1-0.dll	_ldclass
api-ms-win-crt-string-l1-1-0.dll	strspn
api-ms-win-crt-utility-l1-1-0.dll	qsort
api-ms-win-crt-environment-l1-1-0.dll	getenv
api-ms-win-crt-stdio-l1-1-0.dll	ungetc
api-ms-win-crt-time-l1-1-0.dll	_time64
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64i32
api-ms-win-crt-locale-l1-1-0.dll	localeconv
api-ms-win-crt-convert-l1-1-0.dll	strtol

Exports

Name	Ordinal	Address
OPENSSL_Applink	1	0x1400af0e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 7KlNbK2xkt.exePID: 1868, Parent PID: 4084

General

Target ID:	0
Start time:	01:19:12
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\7KlNbK2xkt.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\7KlNbK2xkt.exe"
Imagebase:	0x7ff6e67d0000
File size:	19'278'864 bytes
MD5 hash:	CA9F0F2DDA1CB0439275F6D975DABCF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2332, Parent PID: 1868

General

Target ID:	2
Start time:	01:19:13
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ipconfig /flushdns
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2344, Parent PID: 2332

General

Target ID:	3
Start time:	01:19:13
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: ipconfig.exePID: 2340, Parent PID: 2332

General

Target ID:	4
Start time:	01:19:13
Start date:	05/01/2025
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /flushdns
Imagebase:	0x7ff7d3c00000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3700, Parent PID: 1868

General

Target ID:	5
Start time:	01:19:13
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c netsh interface ip delete arpcache
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2772, Parent PID: 3700

General

Target ID:	6
Start time:	01:19:14
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 2768, Parent PID: 3700

General

Target ID:	7
Start time:	01:19:14
Start date:	05/01/2025
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh interface ip delete arpcache
Imagebase:	0x7ff787280000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4128, Parent PID: 1868

General

Target ID:	8
Start time:	01:19:14
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c certutil -URLCache * delete
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6816, Parent PID: 4128

General

Target ID:	9
Start time:	01:19:14
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: certutil.exePID: 5620, Parent PID: 4128

General

Target ID:	10
Start time:	01:19:14
Start date:	05/01/2025
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	certutil -URLCache * delete
Imagebase:	0x7ff71d220000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7104, Parent PID: 1868

General

Target ID:	12
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c netsh int ip reset
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3772, Parent PID: 7104

General

Target ID:	13
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 3404, Parent PID: 7104

General

Target ID:	14
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh int ip reset
Imagebase:	0x7ff787280000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6108, Parent PID: 1868

General

Target ID:	15
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c netsh int ipv4 reset
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5868, Parent PID: 6108

General

Target ID:	16
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 5904, Parent PID: 6108

General

Target ID:	17
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh int ipv4 reset
Imagebase:	0x7ff787280000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4300, Parent PID: 1868

General

Target ID:	18
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c netsh int ipv6 reset
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2848, Parent PID: 4300

General

Target ID:	19
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 4040, Parent PID: 4300

General

Target ID:	20
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh int ipv6 reset
Imagebase:	0x7ff787280000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4568, Parent PID: 1868

General

Target ID:	21
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c netsh winsock reset
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4536, Parent PID: 4568

General

Target ID:	22
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 3344, Parent PID: 4568

General

Target ID:	23
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh winsock reset
Imagebase:	0x7ff787280000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4124, Parent PID: 1868

General

Target ID:	24
Start time:	01:19:16
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ping -w 250 -n 1 144.217.123.198
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2344, Parent PID: 4124

General

Target ID:	25
Start time:	01:19:16
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: PING.EXEPID: 2852, Parent PID: 4124

General

Target ID:	26
Start time:	01:19:16
Start date:	05/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -w 250 -n 1 144.217.123.198
Imagebase:	0x7ff6d2270000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3120, Parent PID: 1868

General

Target ID:	27
Start time:	01:19:16
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ping -w 250 -n 1 144.217.123.200
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1384, Parent PID: 3120

General

Target ID:	28
Start time:	01:19:16
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: PING.EXEPID: 2740, Parent PID: 3120

General

Target ID:	29
Start time:	01:19:16
Start date:	05/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -w 250 -n 1 144.217.123.200
Imagebase:	0x7ff6d2270000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5616, Parent PID: 1868

General

Target ID:	30
Start time:	01:19:17
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ping -w 250 -n 1 144.217.123.202
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1012, Parent PID: 5616

General

Target ID:	31
Start time:	01:19:17
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: PING.EXEPID: 4476, Parent PID: 5616

General

Target ID:	32
Start time:	01:19:17
Start date:	05/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -w 250 -n 1 144.217.123.202
Imagebase:	0x7ff6d2270000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3552, Parent PID: 1868

General

Target ID:	33
Start time:	01:19:17
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ping -w 250 -n 1 144.217.153.89
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4136, Parent PID: 3552

General

Target ID:	34
Start time:	01:19:17
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: PING.EXEPID: 5316, Parent PID: 3552

General

Target ID:	35
Start time:	01:19:17
Start date:	05/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -w 250 -n 1 144.217.153.89
Imagebase:	0x7ff6d2270000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3772, Parent PID: 1868

General

Target ID:	36
Start time:	01:19:18
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ping -w 250 -n 1 144.217.153.92
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3760, Parent PID: 3772

General

Target ID:	37
Start time:	01:19:18
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: PING.EXEPID: 2220, Parent PID: 3772

General

Target ID:	38
Start time:	01:19:18
Start date:	05/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -w 250 -n 1 144.217.153.92
Imagebase:	0x7ff6d2270000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6872, Parent PID: 1868

General

Target ID:	39
Start time:	01:19:18
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ping -w 250 -n 1 192.95.19.137
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5904, Parent PID: 6872

General

Target ID:	40
Start time:	01:19:18
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: PING.EXEPID: 4424, Parent PID: 6872

General

Target ID:	41
Start time:	01:19:18
Start date:	05/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -w 250 -n 1 192.95.19.137
Imagebase:	0x7ff6d2270000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4200, Parent PID: 1868

General

Target ID:	42
Start time:	01:19:19
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ping -w 250 -n 1 192.99.98.193
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3648, Parent PID: 4200

General

Target ID:	43
Start time:	01:19:19
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: PING.EXEPID: 4152, Parent PID: 4200

General

Target ID:	44
Start time:	01:19:19
Start date:	05/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -w 250 -n 1 192.99.98.193
Imagebase:	0x7ff6d2270000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3608, Parent PID: 1868

General

Target ID:	45
Start time:	01:19:19
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ping -w 250 -n 1 192.95.20.7
Imagebase:	0x7ff6c66d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4936, Parent PID: 3608

General

Target ID:	46
Start time:	01:19:19
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: PING.EXEPID: 4536, Parent PID: 3608

General

Target ID:	47
Start time:	01:19:19
Start date:	05/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -w 250 -n 1 192.95.20.7
Imagebase:	0x7ff6d2270000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7KlNbK2xkt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
7KlNbK2xkt.exe