Source: payload.exe | Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE |
Source: payload.exe | Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
Source: | Binary string: m.pdb*, q_Hi source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp |
Source: | Binary string: 0C:\Windows\System.pdbG>g source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp |
Source: payload.exe, 00000001.00000002.1297195072.000000000053C000.00000004.00000020.sdmp | Binary or memory string: OriginalFilenameclr.dllT vs payload.exe |
Source: payload.exe, 00000001.00000002.1296955099.0000000000104000.00000002.00020000.sdmp | Binary or memory string: OriginalFilenameShell.exe$ vs payload.exe |
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp | Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs payload.exe |
Source: payload.exe | Binary or memory string: OriginalFilenameShell.exe$ vs payload.exe |
Source: payload.exe | Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE |
Source: 1.0.payload.exe.100000.0.unpack, Program.cs | Suspicious method names: System.Void Payload.Program::.ctor() |
Source: 1.0.payload.exe.100000.0.unpack, Program.cs | Suspicious method names: System.Void Payload.Program::Main(System.String[]) |
Source: 1.0.payload.exe.100000.0.unpack, Program.cs | Suspicious method names: System.Void Payload.Program::<Main>m__0(System.Object) |
Source: 1.0.payload.exe.100000.0.unpack, Program.cs | Suspicious method names: System.Void Payload.Program::Shell() |
Source: 1.0.payload.exe.100000.0.unpack, Program.cs | Suspicious method names: System.Void Payload.Program::CmdOutputDataHandler(System.Object,System.Diagnostics.DataReceivedEventArgs) |
Source: payload.exe, Program.cs | Suspicious method names: System.Void Payload.Program::.ctor() |
Source: payload.exe, Program.cs | Suspicious method names: System.Void Payload.Program::Main(System.String[]) |
Source: payload.exe, Program.cs | Suspicious method names: System.Void Payload.Program::<Main>m__0(System.Object) |
Source: payload.exe, Program.cs | Suspicious method names: System.Void Payload.Program::Shell() |
Source: payload.exe, Program.cs | Suspicious method names: System.Void Payload.Program::CmdOutputDataHandler(System.Object,System.Diagnostics.DataReceivedEventArgs) |
Source: 1.2.payload.exe.100000.0.unpack, Program.cs | Suspicious method names: System.Void Payload.Program::.ctor() |
Source: 1.2.payload.exe.100000.0.unpack, Program.cs | Suspicious method names: System.Void Payload.Program::Main(System.String[]) |
Source: 1.2.payload.exe.100000.0.unpack, Program.cs | Suspicious method names: System.Void Payload.Program::<Main>m__0(System.Object) |
Source: 1.2.payload.exe.100000.0.unpack, Program.cs | Suspicious method names: System.Void Payload.Program::Shell() |
Source: 1.2.payload.exe.100000.0.unpack, Program.cs | Suspicious method names: System.Void Payload.Program::CmdOutputDataHandler(System.Object,System.Diagnostics.DataReceivedEventArgs) |
Source: classification engine | Classification label: mal48.winEXE@2/1@0/1 |
Source: C:\Windows\System32\conhost.exe | Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_01 |
Source: payload.exe | Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
Source: unknown | Process created: C:\Users\user\Desktop\payload.exe 'C:\Users\user\Desktop\payload.exe' |
Source: C:\Users\user\Desktop\payload.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Source: payload.exe | Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR |
Source: payload.exe | Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
Source: | Binary string: m.pdb*, q_Hi source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp |
Source: | Binary string: 0C:\Windows\System.pdbG>g source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 420000 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419891 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419781 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419672 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419562 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419453 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419344 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419234 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419125 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419016 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418906 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418797 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418687 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418578 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418469 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418359 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418250 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418141 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418031 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417922 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417812 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417703 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417594 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417484 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417375 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417266 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417156 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417047 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416937 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416828 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416719 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416609 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416500 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416391 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416281 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416172 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416062 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415953 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415843 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415734 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415625 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415516 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415406 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415297 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415187 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415078 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 414969 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 414859 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 414750 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 414641 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 414531 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -23058430092136925s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -420000s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -419891s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -419781s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -419672s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -419562s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -419453s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -419344s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -419234s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -419125s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -419016s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -418906s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -418797s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -418687s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -418578s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -418469s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -418359s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -418250s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -418141s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -418031s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -417922s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -417812s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -417703s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -417594s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -417484s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -417375s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -417266s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -417156s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -417047s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -416937s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -416828s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -416719s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -416609s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -416500s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -416391s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -416281s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -416172s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -416062s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -415953s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -415843s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -415734s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -415625s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -415516s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -415406s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -415297s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -415187s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -415078s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -414969s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -414859s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -414750s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -414641s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe TID: 6108 | Thread sleep time: -414531s >= -30000s | Jump to behavior |
Source: all processes | Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected |
Source: C:\Windows\System32\conhost.exe | Last function: Thread delayed |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 420000 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419891 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419781 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419672 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419562 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419453 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419344 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419234 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419125 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 419016 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418906 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418797 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418687 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418578 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418469 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418359 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418250 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418141 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 418031 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417922 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417812 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417703 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417594 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417484 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417375 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417266 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417156 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 417047 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416937 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416828 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416719 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416609 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416500 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416391 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416281 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416172 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 416062 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415953 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415843 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415734 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415625 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415516 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415406 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415297 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415187 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 415078 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 414969 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 414859 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 414750 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 414641 | Jump to behavior |
Source: C:\Users\user\Desktop\payload.exe | Thread delayed: delay time: 414531 | Jump to behavior |
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp | Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed. |
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp | Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service. |
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp | Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported. |
Source: payload.exe, 00000001.00000002.1297256206.0000000000599000.00000004.00000020.sdmp | Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll |
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp | Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service. |
Source: all processes | Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected |
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp | Binary or memory string: Shell_TrayWnd |
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp | Binary or memory string: Progman |
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp | Binary or memory string: SProgram Managerl |
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp | Binary or memory string: Shell_TrayWnd, |
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp | Binary or memory string: Progmanlock |
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.