Windows Analysis Report
Vhl3X1aYeU.exe

AI detected suspicious sample

Source: Yara match	File source: Vhl3X1aYeU.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Vhl3X1aYeU.exe PID: 6272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Vhl3X1aYeU.exe

Joe Sandbox ML: detected

Source: Vhl3X1aYeU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Contains functionality to spread to USB devices (.Net source)

Source: Vhl3X1aYeU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Source: Vhl3X1aYeU.exe, Usb1.cs	.Net Code: infect
Source: Explower.exe.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe0.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe1.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe2.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe3.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe4.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe5.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe6.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe7.0.dr, Usb1.cs	.Net Code: infect

Source: Vhl3X1aYeU.exe, 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: Vhl3X1aYeU.exe, 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: Vhl3X1aYeU.exe, 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Vhl3X1aYeU.exe	Binary or memory string: \autorun.inf
Source: Vhl3X1aYeU.exe	Binary or memory string: [autorun]
Source: Vhl3X1aYeU.exe	Binary or memory string: autorun.inf
Source: Explower.exe2.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe2.0.dr	Binary or memory string: [autorun]
Source: Explower.exe2.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe.0.dr	Binary or memory string: [autorun]
Source: Explower.exe.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe1.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe1.0.dr	Binary or memory string: [autorun]
Source: Explower.exe1.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe4.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe4.0.dr	Binary or memory string: [autorun]
Source: Explower.exe4.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe3.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe3.0.dr	Binary or memory string: [autorun]
Source: Explower.exe3.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe7.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe7.0.dr	Binary or memory string: [autorun]
Source: Explower.exe7.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe6.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe6.0.dr	Binary or memory string: [autorun]
Source: Explower.exe6.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe0.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe0.0.dr	Binary or memory string: [autorun]
Source: Explower.exe0.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe5.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe5.0.dr	Binary or memory string: [autorun]
Source: Explower.exe5.0.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49730 -> 77.90.22.45:3333
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49730 -> 77.90.22.45:3333
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49730 -> 77.90.22.45:3333

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 77.90.22.45:3333

Source: Joe Sandbox View

ASN Name: ASGHOSTNETDE ASGHOSTNETDE

Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 77.90.22.45

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: Vhl3X1aYeU.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Vhl3X1aYeU.exe PID: 6272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

System Summary

Source: Vhl3X1aYeU.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: Vhl3X1aYeU.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: Vhl3X1aYeU.exe, type: SAMPLE	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: Vhl3X1aYeU.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: Vhl3X1aYeU.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00EABCEE NtQuerySystemInformation,		0_2_00EABCEE
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00EABCBD NtQuerySystemInformation,		0_2_00EABCBD

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Windows\SysWOW64\Explower.exe			Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Windows\SysWOW64\Explower.exe:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00EA2BCF	0_2_00EA2BCF
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE4298	0_2_00FE4298
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE7288	0_2_00FE7288
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE49F9	0_2_00FE49F9
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE44F1	0_2_00FE44F1
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE50E3	0_2_00FE50E3
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE47D4	0_2_00FE47D4
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE499D	0_2_00FE499D
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE4F9D	0_2_00FE4F9D
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE4C8F	0_2_00FE4C8F
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE726E	0_2_00FE726E
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE536F	0_2_00FE536F
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE505D	0_2_00FE505D
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE4B5B	0_2_00FE4B5B
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE4544	0_2_00FE4544
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE4936	0_2_00FE4936
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE4630	0_2_00FE4630
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE4F2F	0_2_00FE4F2F
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE470F	0_2_00FE470F
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE5000	0_2_00FE5000
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00FE5459	0_2_00FE5459

Source: Vhl3X1aYeU.exe, 00000000.00000002.4122223043.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs Vhl3X1aYeU.exe

Source: Vhl3X1aYeU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Vhl3X1aYeU.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: Vhl3X1aYeU.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Vhl3X1aYeU.exe, type: SAMPLE	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: Vhl3X1aYeU.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: Vhl3X1aYeU.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.phis.troj.adwa.evad.winEXE@11/23@0/1

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00EABB72 AdjustTokenPrivileges,		0_2_00EABB72
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_00EABB3B AdjustTokenPrivileges,		0_2_00EABB3B

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File created: C:\Program Files (x86)\Explower.exe

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File created: C:\Users\user\AppData\Roaming\app

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3512:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Mutant created: \Sessions\1\BaseNamedObjects\7d8b54f61658224964f27b9b12cf7d70
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:980:120:WilError_03
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6572:120:WilError_03

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Source: Vhl3X1aYeU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Vhl3X1aYeU.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Vhl3X1aYeU.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File read: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Source: unknown	Process created: C:\Users\user\Desktop\Vhl3X1aYeU.exe "C:\Users\user\Desktop\Vhl3X1aYeU.exe"
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe" "Vhl3X1aYeU.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe"
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe" "Vhl3X1aYeU.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe" "Vhl3X1aYeU.exe" ENABLE	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe" "Vhl3X1aYeU.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: shfolder.dll	Jump to behavior

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: Vhl3X1aYeU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

.NET source code contains potential unpacker

Source: Vhl3X1aYeU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: Vhl3X1aYeU.exe, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe0.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe1.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe2.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe3.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe4.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe5.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe6.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe7.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Code function: 0_2_06750A4B push 6A47C310h; ret		0_2_06750A62
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Code function: 7_2_04E33141 pushad ; ret		7_2_04E33154

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File created: C:\Users\user\Documents\Explower.exe

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Windows\SysWOW64\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Users\user\AppData\Local\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Program Files (x86)\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Users\user\Documents\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Users\user\Favorites\Explower.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File created: C:\Program Files (x86)\Explower.exe

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File created: C:\Windows\SysWOW64\Explower.exe

Drops PE files to the startup folder

Boot Survival

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe			Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 2C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 4C40000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 5AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 6AA0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 6CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 7CD0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 7F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 8F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 9F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 6060000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 7CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 9F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: AF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: BF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: CF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: DF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: EF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 8F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: FF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 10F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 11F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: A400000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 12F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 13F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 14F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 15F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 16F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 17F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 18F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 19F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1AF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: C520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: D520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: E520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1BF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1CF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1DF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1EF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1FF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 20F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 21F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 22F20000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 24130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 25130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 26130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 27130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 28130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 29130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 2A130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 2B130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 2C130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 2D130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: F520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: C620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: D620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: E620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: F620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: D660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: E660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: F660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 10660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 11660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 12660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: F7A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 107A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 117A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 127A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 137A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 147A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 157A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 167A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 177A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 187A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 197A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1A7A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1B7A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1C7A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1D7A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1E7A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 1F7A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 207A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 217A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 2E130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 2F130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 30130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Memory allocated: 31130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 2C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 4C00000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Window / User API: threadDelayed 2834	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Window / User API: threadDelayed 1580	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Window / User API: foregroundWindowGot 410	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Window / User API: foregroundWindowGot 421	Jump to behavior

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe TID: 1344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe TID: 1344	Thread sleep count: 253 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe TID: 2492	Thread sleep count: 2834 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe TID: 2492	Thread sleep time: -1417000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe TID: 2812	Thread sleep count: 187 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe TID: 2304	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe TID: 2492	Thread sleep count: 1580 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe TID: 2492	Thread sleep time: -790000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe TID: 600	Thread sleep count: 67 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe TID: 5448	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: netsh.exe, 00000001.00000002.1699675996.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.1732889308.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
Source: Vhl3X1aYeU.exe, 00000000.00000002.4122223043.0000000000B83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWrvices, Versio
Source: Vhl3X1aYeU.exe, 00000000.00000002.4122223043.0000000000B83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll#
Source: netsh.exe, 00000003.00000002.1728117183.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Memory allocated: page read and write | page guard

Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:18 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:59:36 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:28:56 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 19:01:50 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:01:13 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:20 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:00:01 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:45 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:59:08 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:40 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:06:27 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:00 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:59:31 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:59:24 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:12 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 10:51:05 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 11:27:45 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 06:12:19 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:05:39 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:34 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:40 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:36 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:01:07 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:50 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 00:35:17 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:26 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:36 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:26:42 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 11:11:59 - Program Manager
Source: Explower.exe, 00000007.00000002.1837225047.000000000511B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dProgram Manager`
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, Explower.exe, 00000007.00000002.1836870113.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:15 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:28 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, Explower.exe, 00000007.00000002.1836870113.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, Explower.exe, 00000007.00000002.1836870113.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 19:30:17 - Program Manager
Source: Vhl3X1aYeU.exe, Explower.exe2.0.dr, Explower.exe.0.dr, Explower.exe1.0.dr, Explower.exe4.0.dr, Explower.exe3.0.dr, Explower.exe7.0.dr, Explower.exe6.0.dr, Explower.exe0.0.dr, Explower.exe5.0.dr	Binary or memory string: ProgMan
Source: Explower.exe, 00000007.00000002.1836870113.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, Explower.exe, 00000007.00000002.1836870113.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: kedProgram Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:23 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:59:18 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:55 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:30 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:00:24 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:19 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 07:53:28 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:26 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:27 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:30:14 - Program Manager
Source: Vhl3X1aYeU.exe, Explower.exe2.0.dr, Explower.exe.0.dr, Explower.exe1.0.dr, Explower.exe4.0.dr, Explower.exe3.0.dr, Explower.exe7.0.dr, Explower.exe6.0.dr, Explower.exe0.0.dr, Explower.exe5.0.dr	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:31 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:23 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:33 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:11 - Program Manager
Source: Vhl3X1aYeU.exe, Explower.exe2.0.dr, Explower.exe.0.dr, Explower.exe1.0.dr, Explower.exe4.0.dr, Explower.exe3.0.dr, Explower.exe7.0.dr, Explower.exe6.0.dr, Explower.exe0.0.dr, Explower.exe5.0.dr	Binary or memory string: Shell_TrayWnd
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:01 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:15 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:07:17 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:42 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:01:53 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 19:01:16 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:57:39 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:01:33 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 18:37:06 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:04 - Program Manager
Source: Vhl3X1aYeU.exe, 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 17:58:14 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality to disable the Task Manager (.Net Source)

Lowering of HIPS / PFW / Operating System Security Settings

Source: Vhl3X1aYeU.exe, Fransesco.cs	.Net Code: INS
Source: Explower.exe.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe0.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe1.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe2.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe3.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe4.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe5.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe6.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe7.0.dr, Fransesco.cs	.Net Code: INS

Disables zone checking for all users

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Modifies the windows firewall

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe" "Vhl3X1aYeU.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\Vhl3X1aYeU.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe" "Vhl3X1aYeU.exe" ENABLE

Stealing of Sensitive Information

Source: Yara match	File source: Vhl3X1aYeU.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Vhl3X1aYeU.exe PID: 6272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

Remote Access Functionality

Source: Yara match	File source: Vhl3X1aYeU.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Vhl3X1aYeU.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Vhl3X1aYeU.exe PID: 6272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	11 Replication Through Removable Media	Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	1 Access Token Manipulation	32 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Process Injection	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Vhl3X1aYeU.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
Vhl3X1aYeU.exe	100%	Avira	TR/Dropper.Gen
Vhl3X1aYeU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Documents\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Favorites\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Windows\SysWOW64\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.90.22.45	unknown	Germany		12586	ASGHOSTNETDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585656
Start date and time:	2025-01-07 23:56:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Vhl3X1aYeU.exe renamed because original name is a hash value
Original Sample Name:	0b06ffc35e57fa882d381e2516890367.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.adwa.evad.winEXE@11/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 180 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Vhl3X1aYeU.exe

Simulations

Behavior and APIs

Time	Type	Description
17:57:39	API Interceptor	105103x Sleep call for process: Vhl3X1aYeU.exe modified
22:57:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.90.22.45	build.exe	Get hash	malicious	RedLine	Browse	77.90.22.45:15352/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASGHOSTNETDE	build.exe	Get hash	malicious	RedLine	Browse	77.90.22.45
	server.exe	Get hash	malicious	Njrat	Browse	77.90.22.45
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	77.90.25.227
	armv5l.elf	Get hash	malicious	Unknown	Browse	5.231.4.240
	mipsel.elf	Get hash	malicious	Unknown	Browse	5.231.4.240
	powerpc.elf	Get hash	malicious	Unknown	Browse	5.231.4.240
	mips.elf	Get hash	malicious	Unknown	Browse	5.231.4.240
	sparc.elf	Get hash	malicious	Unknown	Browse	5.230.251.14
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	5.230.157.188
	armv4l.elf	Get hash	malicious	Unknown	Browse	5.231.4.240

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560028663711633
Encrypted:	false
SSDEEP:	1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
MD5:	0B06FFC35E57FA882D381E2516890367
SHA1:	5F1AAE9F6368528637E5FF05562366B306456D80
SHA-256:	56B3DDAC0C8B5D6E4E31C452A200BAF843ACD84D174D05DB0317F28F79B4F9CD
SHA-512:	CF386BD0B9FA0B2358DFA9C9CA8C5D12142F3AEFA4B461FFBE0D12F1FFC1BE6D6581EF7A917B4E456368DBA7E9C53ED5BCC13FD06893C49882F7FE23D4C0959F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Program Files (x86)\Explower.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Program Files (x86)\Explower.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Program Files (x86)\Explower.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Program Files (x86)\Explower.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Program Files (x86)\Explower.exe, Author: Sekoia.io Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Program Files (x86)\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Explower.exe

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560028663711633
Encrypted:	false
SSDEEP:	1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
MD5:	0B06FFC35E57FA882D381E2516890367
SHA1:	5F1AAE9F6368528637E5FF05562366B306456D80
SHA-256:	56B3DDAC0C8B5D6E4E31C452A200BAF843ACD84D174D05DB0317F28F79B4F9CD
SHA-512:	CF386BD0B9FA0B2358DFA9C9CA8C5D12142F3AEFA4B461FFBE0D12F1FFC1BE6D6581EF7A917B4E456368DBA7E9C53ED5BCC13FD06893C49882F7FE23D4C0959F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Explower.exe.log

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560028663711633
Encrypted:	false
SSDEEP:	1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
MD5:	0B06FFC35E57FA882D381E2516890367
SHA1:	5F1AAE9F6368528637E5FF05562366B306456D80
SHA-256:	56B3DDAC0C8B5D6E4E31C452A200BAF843ACD84D174D05DB0317F28F79B4F9CD
SHA-512:	CF386BD0B9FA0B2358DFA9C9CA8C5D12142F3AEFA4B461FFBE0D12F1FFC1BE6D6581EF7A917B4E456368DBA7E9C53ED5BCC13FD06893C49882F7FE23D4C0959F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560028663711633
Encrypted:	false
SSDEEP:	1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
MD5:	0B06FFC35E57FA882D381E2516890367
SHA1:	5F1AAE9F6368528637E5FF05562366B306456D80
SHA-256:	56B3DDAC0C8B5D6E4E31C452A200BAF843ACD84D174D05DB0317F28F79B4F9CD
SHA-512:	CF386BD0B9FA0B2358DFA9C9CA8C5D12142F3AEFA4B461FFBE0D12F1FFC1BE6D6581EF7A917B4E456368DBA7E9C53ED5BCC13FD06893C49882F7FE23D4C0959F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560028663711633
Encrypted:	false
SSDEEP:	1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
MD5:	0B06FFC35E57FA882D381E2516890367
SHA1:	5F1AAE9F6368528637E5FF05562366B306456D80
SHA-256:	56B3DDAC0C8B5D6E4E31C452A200BAF843ACD84D174D05DB0317F28F79B4F9CD
SHA-512:	CF386BD0B9FA0B2358DFA9C9CA8C5D12142F3AEFA4B461FFBE0D12F1FFC1BE6D6581EF7A917B4E456368DBA7E9C53ED5BCC13FD06893C49882F7FE23D4C0959F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560028663711633
Encrypted:	false
SSDEEP:	1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
MD5:	0B06FFC35E57FA882D381E2516890367
SHA1:	5F1AAE9F6368528637E5FF05562366B306456D80
SHA-256:	56B3DDAC0C8B5D6E4E31C452A200BAF843ACD84D174D05DB0317F28F79B4F9CD
SHA-512:	CF386BD0B9FA0B2358DFA9C9CA8C5D12142F3AEFA4B461FFBE0D12F1FFC1BE6D6581EF7A917B4E456368DBA7E9C53ED5BCC13FD06893C49882F7FE23D4C0959F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\app

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:X:X
MD5:	FBA73CE50D8CFB469EC29A2333B22A85
SHA1:	4B7B6DFB36AF4A016301DC065870DD0829DB0A55
SHA-256:	56AE4E1144656432194C610E366FB556F7401A9993E75C0007F46397A5DDFA03
SHA-512:	B620D99E15C25E970A09738D14B493B2345EC1EB48737E2983565666A3C052D235712DB01A110C9948DC00D62A14FCCCF43CCC295F993D673334DC88497C77C7
Malicious:	false
Preview:	.7

C:\Users\user\Documents\Explower.exe

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560028663711633
Encrypted:	false
SSDEEP:	1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
MD5:	0B06FFC35E57FA882D381E2516890367
SHA1:	5F1AAE9F6368528637E5FF05562366B306456D80
SHA-256:	56B3DDAC0C8B5D6E4E31C452A200BAF843ACD84D174D05DB0317F28F79B4F9CD
SHA-512:	CF386BD0B9FA0B2358DFA9C9CA8C5D12142F3AEFA4B461FFBE0D12F1FFC1BE6D6581EF7A917B4E456368DBA7E9C53ED5BCC13FD06893C49882F7FE23D4C0959F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Documents\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Favorites\Explower.exe

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560028663711633
Encrypted:	false
SSDEEP:	1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
MD5:	0B06FFC35E57FA882D381E2516890367
SHA1:	5F1AAE9F6368528637E5FF05562366B306456D80
SHA-256:	56B3DDAC0C8B5D6E4E31C452A200BAF843ACD84D174D05DB0317F28F79B4F9CD
SHA-512:	CF386BD0B9FA0B2358DFA9C9CA8C5D12142F3AEFA4B461FFBE0D12F1FFC1BE6D6581EF7A917B4E456368DBA7E9C53ED5BCC13FD06893C49882F7FE23D4C0959F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Favorites\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\Explower.exe

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560028663711633
Encrypted:	false
SSDEEP:	1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
MD5:	0B06FFC35E57FA882D381E2516890367
SHA1:	5F1AAE9F6368528637E5FF05562366B306456D80
SHA-256:	56B3DDAC0C8B5D6E4E31C452A200BAF843ACD84D174D05DB0317F28F79B4F9CD
SHA-512:	CF386BD0B9FA0B2358DFA9C9CA8C5D12142F3AEFA4B461FFBE0D12F1FFC1BE6D6581EF7A917B4E456368DBA7E9C53ED5BCC13FD06893C49882F7FE23D4C0959F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Windows\SysWOW64\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.560028663711633
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Vhl3X1aYeU.exe
File size:	95'232 bytes
MD5:	0b06ffc35e57fa882d381e2516890367
SHA1:	5f1aae9f6368528637e5ff05562366b306456d80
SHA256:	56b3ddac0c8b5d6e4e31c452a200baf843acd84d174d05db0317f28f79b4f9cd
SHA512:	cf386bd0b9fa0b2358dfa9c9ca8c5d12142f3aefa4b461ffbe0d12f1ffc1be6d6581ef7a917b4e456368dba7e9c53ed5bcc13fd06893c49882f7fe23d4c0959f
SSDEEP:	1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
TLSH:	A893E84977E52524E5BF56F79871F2004E34B48B1602E39D48F219AA1B33AC44F89FEB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g.................p............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x418efe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x677C1A11 [Mon Jan 6 17:59:45 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18ea8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f04	0x17000	7a35295feb40ef132602d0ca762e331d	False	0.3681003736413043	data	5.591903135296159	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	02466978873e232bef309f048b95192f	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T23:57:07.036622+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49730	77.90.22.45	3333	TCP
2025-01-07T23:57:07.036622+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49730	77.90.22.45	3333	TCP
2025-01-07T23:57:13.075499+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49730	77.90.22.45	3333	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 23:57:06.165402889 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:57:06.170352936 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:57:06.172873020 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:57:07.036622047 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:57:07.042670012 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:57:07.042855024 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:57:07.047658920 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:57:12.710295916 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:57:12.748850107 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:57:12.753655910 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:57:13.075499058 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:57:13.080440044 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:57:30.731965065 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:57:30.732311964 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:57:30.737183094 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:57:48.804514885 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:57:48.826292992 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:57:48.831139088 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:58:06.835944891 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:58:06.836282969 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:58:06.841113091 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:58:24.960571051 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:58:24.960860014 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:58:24.965648890 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:58:43.038549900 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:58:43.038798094 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:58:43.043622971 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:59:01.118788004 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:59:01.119044065 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:59:01.124804974 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:59:19.171444893 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:59:19.356848001 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:59:20.638317108 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:59:20.643192053 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:59:37.290308952 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:59:37.290709019 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:59:37.295535088 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:59:55.366852999 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 7, 2025 23:59:55.370661020 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 7, 2025 23:59:55.376338959 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 8, 2025 00:00:13.430172920 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 8, 2025 00:00:13.560153961 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 8, 2025 00:00:14.149641991 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 8, 2025 00:00:14.154480934 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 8, 2025 00:00:31.507853985 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 8, 2025 00:00:31.508285046 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 8, 2025 00:00:31.513066053 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 8, 2025 00:00:49.542241096 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 8, 2025 00:00:49.542561054 CET	49730	3333	192.168.2.4	77.90.22.45
Jan 8, 2025 00:00:49.553407907 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 8, 2025 00:01:07.601222038 CET	3333	49730	77.90.22.45	192.168.2.4
Jan 8, 2025 00:01:07.653970003 CET	49730	3333	192.168.2.4	77.90.22.45

Target ID:	0
Start time:	17:56:59
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Vhl3X1aYeU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Vhl3X1aYeU.exe"
Imagebase:	0x5a0000
File size:	95'232 bytes
MD5 hash:	0B06FFC35E57FA882D381E2516890367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1671418007.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.4123012226.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	17:57:00
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe" "Vhl3X1aYeU.exe" ENABLE
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	17:57:00
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	17:57:02
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall delete allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe"
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	17:57:02
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\Vhl3X1aYeU.exe" "Vhl3X1aYeU.exe" ENABLE
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	17:57:02
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	17:57:02
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	17:57:13
Start date:	07/01/2025
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"
Imagebase:	0x760000
File size:	95'232 bytes
MD5 hash:	0B06FFC35E57FA882D381E2516890367
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	true