Windows Analysis Report
IM3OLcx7li.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 0.2.IM3OLcx7li.exe.30b1b50.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.IM3OLcx7li.exe.30c4190.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.0.XClient.exe.450000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.1417942243.0000000000452000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1419994885.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\FluxusV1.2, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\AppData\Roaming\XClient.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFB4B069446	2_2_00007FFB4B069446
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFB4B06186D	2_2_00007FFB4B06186D
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFB4B06A1F2	2_2_00007FFB4B06A1F2
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFB4B062059	2_2_00007FFB4B062059
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFB4B060EBD	2_2_00007FFB4B060EBD
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Code function: 3_2_00007FFB4B056DB0	3_2_00007FFB4B056DB0
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Code function: 3_2_00007FFB4B062540	3_2_00007FFB4B062540

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\Bootstrapper.exe EBBCB489171ABFCFCE56554DBAEACD22A15838391CBC7C756DB02995129DEF5A

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7616 -s 2192

Source: IM3OLcx7li.exe, 00000000.00000002.1419994885.0000000003091000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs IM3OLcx7li.exe
Source: IM3OLcx7li.exe, 00000000.00000000.1412224191.0000000000C90000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOutput.exe4 vs IM3OLcx7li.exe
Source: IM3OLcx7li.exe	Binary or memory string: OriginalFilenameOutput.exe4 vs IM3OLcx7li.exe

Source: IM3OLcx7li.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.IM3OLcx7li.exe.30b1b50.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.IM3OLcx7li.exe.30c4190.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.0.XClient.exe.450000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.1417942243.0000000000452000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1419994885.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\FluxusV1.2, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: IM3OLcx7li.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: IM3OLcx7li.exe, 2vQWjXXJimRWbe79pCEPet6wDiJk73.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: FluxusV1.2.2.dr, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: FluxusV1.2.2.dr, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: XClient.exe.0.dr, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Base64 encoded string: 'v9mb9RpVrBE7RDaZZSlVasGbjcVsh5usrfttbXqlgeJyDqdY7cTE2drMR17nvl52fHF5OTPzoyAD9uyH8hwJh9nnne6C', 'sTKUegd6TpziDRxcoIzFv0BJOXNElQ9ZIpYxUFoWs2pQcwvHZ8GRKK5vXXJQB73pBHiVBpX3NNRfjEw4DlGkkZJpqTmY', 'MSmlZMaIU7cagZJvS85lg9zJNBfmNadSV9rvEhajFn7HmNlf5RSq7LIlLR17d0zoxBYpAnlBElZRNKb6sY7PSUOwcgq8', 'iWTpiqA8Xj8vLbi8hQL7UiXhxxev7FsVcOX1my0mhYYIU13dVspHefR4O5juQz61r6JHgNgsqb4NdzBcwHhyyFrO0r8J', 'vHyY0aBSMHEExVeyJXpynUyqZuACd4VQp3WcOk5lh71s5GEdqr8SyBHquZeZXQB8RB5RugZhZmZrNiEBHtN5j38hUwjF', 'pyNITOUQ3ksF4wmIkok3A5BCeUcw8TVzDpWAy3h3bMYyG0v1JdAc47MnLUKAUmGwdDGE0u170UeE3EMZOKBNyQ1jEUfQ', 'X9wex5y9GnKMDDs2F07JPjvRFfUmBBwDgCT0g1B4MFHupra8FLjnPmrbMkiLeEYVwfdrK5CMwLjF6gbJpfkp6SPZOa5h'
Source: XClient.exe.0.dr, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	Base64 encoded string: 'pCqflRx1rdKp8BCVhngIhLeuZVYFpAcvMO6hjX5dIMKNl1gm9Q1Jgwr5sU2f4lpqQeqB97df83qBtJxCzv0U8DZWCo85'
Source: XClient.exe.0.dr, OPQSObGEdF.cs	Base64 encoded string: 'RMWzTVi3Qn2g0BNzSMsRPquCDIC9rga75Gk7iF91H0N9YKINnVoR3zLVkpsZxQ9ExYuWbEg2hz1FA5TZ3wWo2Y6P7uKR', 'nfpBNoNEeEqIg0AuRrroLcpbzjuosrtDMeYp3cOSkk03XFsfxifPWkeGzNgHPQbCpmZjCiIi2pJVZ3NOMSqRRhtvO08d', 'GqNK6Y1mMYvDVzVASSPOKqbpGIizl5M7kp0YF0qQn8kEq1wq25zMNhfIFjck90TbgZfHlzZx2sQRDXWc92hBHfZazCrk'
Source: XClient.exe.0.dr, AhV9cITdXv.cs	Base64 encoded string: 'Id2Rlq0bMyrMvmKMy9Hr0SpA7pjax9NcrH6ko5R6iNreT2VFvbpd8BUXaRJp'
Source: XClient.exe.0.dr, lwCMFX9W8i.cs	Base64 encoded string: 'YpChdJUzj78mlSIIrAPZg71blMMWyS4heKalax9ysig4rslGusL5UOBlg7hJ', 'KPrG7v6iToVv5eokwYpMDJoliNVPXMVCoPiq35deyGOLVbT0VPYgN4J3vJ3R', 'Kn3MjRnALfYYy88AxYxk50IbpqSQy8fk4L1KHkrKOBUCTPjlLcZDqyQIQD77', 'IZodmP7LUAI0C2Pom6YCorxLt8nFONEH3iXaHPHRIfkZNfeDdzKtkVLnZvkL', 'YA3PKorzoKQpSBINQLV4PbSaFrEoAAY0KYkhXXzBLlN88vZZakoWUF3dzCtq', 'RAvxA7r4GZOPoDyRiVX3GnmTjUlesViKv9uLXvJE4yRiPTRgwEdblPX2AwJI', 'tLpbn4h4dOia2QDYqaZRWDdF7zgdC0P2bCuNN5EwO5WaRgH50AqhWCICRm5S', 'QfetLAmJpkpRhQOOF8kDZI9jIWRrAfh7dKOJ2LFQrgf7ny7VmgYk6AcXEfhd'
Source: XClient.exe.0.dr, tiWHr4oL6x.cs	Base64 encoded string: 'H25jbxpjW25c0ZiUrQn1jcJHNJIsFSv9GY1VqM7tX8KvOYe9486CAsg8vGyj', 'xgxETpH56RuE3gfpYeTgQNPU6lWgTqszdVjtLZNq4M0kgNfoW4rCP0k1VshK'
Source: XClient.exe.0.dr, wHUoYuStNT.cs	Base64 encoded string: 'TSzKwKTH65Vvqq35exOuDv6wGfK054sDVjDg4Zu4yB1xRavxiDDPrmTL3HZs', 'hga8ivnVfNF4AFRYDS6Q0YkFgGbmCzHHTPEiOgt3xqAWHD0linjFE5lMr7Cm', 'lSIJI6jVWDk05FfmWqSYz2NXXF0k8dnDgbVMcHlyBc3vK5cIviESTDWCZ0Nb', 'ItLfVWSOgRIuDEX90nulHK3yKn1JIaxOAqL1rC1RaILoWPrHqVz6UvIrdSxS', 'o8ZvL2DDxYuFiF33pyB5gTOJQCtldFQAUncWA6Pm2VJYjm670TbflAKg4A1V', 'jn96YmXwqIuDgAyxjPnkx7fgGO1fgI7XmqwFXDqQp74ZPijTz7KWFUl02uYPDo9rmMYRU8612T2X8LiNb5XgZ6UcXAyA', 'kEAHdMshu3AJAZig6CpRM0yAiphVjJdgWYEmAD3iXQpKvCgnGasxDsp2JSq8dRSZAhXPT5FmXJuS42QnPamgSkDFxlmM', 'ptJkt6r8N0dirVrfyXBqLSo4op4zrOy1vzdybx0PKoIZFLQNgsYF8pQkhtfhKNkL4ULh1VBs2foV7B0FaEBkuSRGw5TW', 'MQKYhoqJT8yqqMZD5e3BGdbY26Priy1ve9MWFvzFKSCdrPvWTdVegFSccX8m5Cm5seZBhRzVidBZts9csSnniF1Is9PA', 'McPLR0iu5mC2jVkdtWEUo6sP6BRWKVSCVIy52Jjrj7OnK8CTv9PVVgY9ky13S5ZknyfXaVQZncy0b6CyzBeV9vruj6bX', 'UQnuQbFElcEKCGng7yYTf6V5CGLMFZAcZLOI82EPHDGhGWjkEB32Znj5UgThpSNrv1z3sM5V9eCcBrKBEN9RDnqWpU0t', 'q6O7Vlf3FrzMbmW3ahTqWmOxSgS1uN8JcMTFQ4jy6wkgTkXTcGuY0TamiqxYnssHSNQp0EFaH8Ib5reommrlTKhNjvyX', 'zb78JyDHMORsh2I1lsBkDCCHWoz5TSuenCS9r07r5GsUd7Wj2BdPC7yzZhxfwHpFlb7ZBsdHM4pBbZ3qmNSqbamKWRPd', 'qnlJfxaQoO7FjUT82yNTkMiMx8CkR1AekpVA0g2SPoWqgoXLvIDJOc0FYsaDxlOIlSbAB61sHiXPXXSufzV5wQNUGAma'
Source: XClient.exe.0.dr, Tg2SEP0VQY.cs	Base64 encoded string: 'SzRAGbZfRW87GpDPTl6mYEdbGfHmbd6JT8oXbLaCaPJUcaAsf9vKKT8j13Ll', 'Mmzvsz5iwN6SLMMKvoVq6bCvZ6zTLOGhh47HaUORTznXMf7m9KaaKbWOZAGC', 'oV4ybiASD8y8LfP6lpUhFYGdS5UnHdm9yChGpzgOKlWhOaCZGbW0YwwomZAG', 'Wzk43dKfG1Ppjd7Je6pU1IK3o32BGizMbgxzVDCLX7WuAfemwOMWLLtJoVQ8', 'xhJXDzNieJxeeUgR2BOUJPpCokeZ9qXSNCMZ6JfOKgEQh46uLI1q8gykPv1j', 'VRsFeUe66XUj0ePqNBTFK89VJLU9WOWbQ6i42016cF5JGYigEncqNA66SZUG', 'VXsWhjt6xyy5IYkdIw89Xr9PQnaI5oZrnBEurRSzdkMYP9LjFH1nkJVVbexD', 'yNVTM18qmFNBktGqtxKFli9xgDkichcjgfOicfyEeMjTc4EdR9blhTM14X2H', 'HKNoxdZgt0mRc1vKuuJ4J06LTfzFrxSOeXWazm92jqH60ofYrnJpAUvWx3L3', 'QV21QSgLRjNIQYlfp3OpYkqJcNEBWEBweGQQ9I1q22c2rc8otAbjs7MqFcTV', 'wK9Pztkryb9RhLB29J25ccWSu3RLvads6Q8T039aoJlQb0iB2P9mfaN6uliv', 'HnMlHzyYFkwda1FuphRZNHnw3WRCAlmGYihdC5xjH3ISX4ZbeAvt8nNT8gYw', 'w0NHNoVUyaAZPeRHPi0W5dAK4WqUsmmLcl1cGTMswGWfDmz800pmj2iYBL2c', 'yfqj3bbJq0sBowqtAh5Ma565il7sQLtQEQ6uAWnzxSWhvya1Pl6Al9ArOoWU', 'mk317UbueRKqoaLeU6QEOLcmSAnM1NGcbzqGTO6gKpX1zEoT5HX05W0L1Uoj'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Base64 encoded string: 'v9mb9RpVrBE7RDaZZSlVasGbjcVsh5usrfttbXqlgeJyDqdY7cTE2drMR17nvl52fHF5OTPzoyAD9uyH8hwJh9nnne6C', 'sTKUegd6TpziDRxcoIzFv0BJOXNElQ9ZIpYxUFoWs2pQcwvHZ8GRKK5vXXJQB73pBHiVBpX3NNRfjEw4DlGkkZJpqTmY', 'MSmlZMaIU7cagZJvS85lg9zJNBfmNadSV9rvEhajFn7HmNlf5RSq7LIlLR17d0zoxBYpAnlBElZRNKb6sY7PSUOwcgq8', 'iWTpiqA8Xj8vLbi8hQL7UiXhxxev7FsVcOX1my0mhYYIU13dVspHefR4O5juQz61r6JHgNgsqb4NdzBcwHhyyFrO0r8J', 'vHyY0aBSMHEExVeyJXpynUyqZuACd4VQp3WcOk5lh71s5GEdqr8SyBHquZeZXQB8RB5RugZhZmZrNiEBHtN5j38hUwjF', 'pyNITOUQ3ksF4wmIkok3A5BCeUcw8TVzDpWAy3h3bMYyG0v1JdAc47MnLUKAUmGwdDGE0u170UeE3EMZOKBNyQ1jEUfQ', 'X9wex5y9GnKMDDs2F07JPjvRFfUmBBwDgCT0g1B4MFHupra8FLjnPmrbMkiLeEYVwfdrK5CMwLjF6gbJpfkp6SPZOa5h'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	Base64 encoded string: 'pCqflRx1rdKp8BCVhngIhLeuZVYFpAcvMO6hjX5dIMKNl1gm9Q1Jgwr5sU2f4lpqQeqB97df83qBtJxCzv0U8DZWCo85'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, OPQSObGEdF.cs	Base64 encoded string: 'RMWzTVi3Qn2g0BNzSMsRPquCDIC9rga75Gk7iF91H0N9YKINnVoR3zLVkpsZxQ9ExYuWbEg2hz1FA5TZ3wWo2Y6P7uKR', 'nfpBNoNEeEqIg0AuRrroLcpbzjuosrtDMeYp3cOSkk03XFsfxifPWkeGzNgHPQbCpmZjCiIi2pJVZ3NOMSqRRhtvO08d', 'GqNK6Y1mMYvDVzVASSPOKqbpGIizl5M7kp0YF0qQn8kEq1wq25zMNhfIFjck90TbgZfHlzZx2sQRDXWc92hBHfZazCrk'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, AhV9cITdXv.cs	Base64 encoded string: 'Id2Rlq0bMyrMvmKMy9Hr0SpA7pjax9NcrH6ko5R6iNreT2VFvbpd8BUXaRJp'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, lwCMFX9W8i.cs	Base64 encoded string: 'YpChdJUzj78mlSIIrAPZg71blMMWyS4heKalax9ysig4rslGusL5UOBlg7hJ', 'KPrG7v6iToVv5eokwYpMDJoliNVPXMVCoPiq35deyGOLVbT0VPYgN4J3vJ3R', 'Kn3MjRnALfYYy88AxYxk50IbpqSQy8fk4L1KHkrKOBUCTPjlLcZDqyQIQD77', 'IZodmP7LUAI0C2Pom6YCorxLt8nFONEH3iXaHPHRIfkZNfeDdzKtkVLnZvkL', 'YA3PKorzoKQpSBINQLV4PbSaFrEoAAY0KYkhXXzBLlN88vZZakoWUF3dzCtq', 'RAvxA7r4GZOPoDyRiVX3GnmTjUlesViKv9uLXvJE4yRiPTRgwEdblPX2AwJI', 'tLpbn4h4dOia2QDYqaZRWDdF7zgdC0P2bCuNN5EwO5WaRgH50AqhWCICRm5S', 'QfetLAmJpkpRhQOOF8kDZI9jIWRrAfh7dKOJ2LFQrgf7ny7VmgYk6AcXEfhd'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, tiWHr4oL6x.cs	Base64 encoded string: 'H25jbxpjW25c0ZiUrQn1jcJHNJIsFSv9GY1VqM7tX8KvOYe9486CAsg8vGyj', 'xgxETpH56RuE3gfpYeTgQNPU6lWgTqszdVjtLZNq4M0kgNfoW4rCP0k1VshK'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, wHUoYuStNT.cs	Base64 encoded string: 'TSzKwKTH65Vvqq35exOuDv6wGfK054sDVjDg4Zu4yB1xRavxiDDPrmTL3HZs', 'hga8ivnVfNF4AFRYDS6Q0YkFgGbmCzHHTPEiOgt3xqAWHD0linjFE5lMr7Cm', 'lSIJI6jVWDk05FfmWqSYz2NXXF0k8dnDgbVMcHlyBc3vK5cIviESTDWCZ0Nb', 'ItLfVWSOgRIuDEX90nulHK3yKn1JIaxOAqL1rC1RaILoWPrHqVz6UvIrdSxS', 'o8ZvL2DDxYuFiF33pyB5gTOJQCtldFQAUncWA6Pm2VJYjm670TbflAKg4A1V', 'jn96YmXwqIuDgAyxjPnkx7fgGO1fgI7XmqwFXDqQp74ZPijTz7KWFUl02uYPDo9rmMYRU8612T2X8LiNb5XgZ6UcXAyA', 'kEAHdMshu3AJAZig6CpRM0yAiphVjJdgWYEmAD3iXQpKvCgnGasxDsp2JSq8dRSZAhXPT5FmXJuS42QnPamgSkDFxlmM', 'ptJkt6r8N0dirVrfyXBqLSo4op4zrOy1vzdybx0PKoIZFLQNgsYF8pQkhtfhKNkL4ULh1VBs2foV7B0FaEBkuSRGw5TW', 'MQKYhoqJT8yqqMZD5e3BGdbY26Priy1ve9MWFvzFKSCdrPvWTdVegFSccX8m5Cm5seZBhRzVidBZts9csSnniF1Is9PA', 'McPLR0iu5mC2jVkdtWEUo6sP6BRWKVSCVIy52Jjrj7OnK8CTv9PVVgY9ky13S5ZknyfXaVQZncy0b6CyzBeV9vruj6bX', 'UQnuQbFElcEKCGng7yYTf6V5CGLMFZAcZLOI82EPHDGhGWjkEB32Znj5UgThpSNrv1z3sM5V9eCcBrKBEN9RDnqWpU0t', 'q6O7Vlf3FrzMbmW3ahTqWmOxSgS1uN8JcMTFQ4jy6wkgTkXTcGuY0TamiqxYnssHSNQp0EFaH8Ib5reommrlTKhNjvyX', 'zb78JyDHMORsh2I1lsBkDCCHWoz5TSuenCS9r07r5GsUd7Wj2BdPC7yzZhxfwHpFlb7ZBsdHM4pBbZ3qmNSqbamKWRPd', 'qnlJfxaQoO7FjUT82yNTkMiMx8CkR1AekpVA0g2SPoWqgoXLvIDJOc0FYsaDxlOIlSbAB61sHiXPXXSufzV5wQNUGAma'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, Tg2SEP0VQY.cs	Base64 encoded string: 'SzRAGbZfRW87GpDPTl6mYEdbGfHmbd6JT8oXbLaCaPJUcaAsf9vKKT8j13Ll', 'Mmzvsz5iwN6SLMMKvoVq6bCvZ6zTLOGhh47HaUORTznXMf7m9KaaKbWOZAGC', 'oV4ybiASD8y8LfP6lpUhFYGdS5UnHdm9yChGpzgOKlWhOaCZGbW0YwwomZAG', 'Wzk43dKfG1Ppjd7Je6pU1IK3o32BGizMbgxzVDCLX7WuAfemwOMWLLtJoVQ8', 'xhJXDzNieJxeeUgR2BOUJPpCokeZ9qXSNCMZ6JfOKgEQh46uLI1q8gykPv1j', 'VRsFeUe66XUj0ePqNBTFK89VJLU9WOWbQ6i42016cF5JGYigEncqNA66SZUG', 'VXsWhjt6xyy5IYkdIw89Xr9PQnaI5oZrnBEurRSzdkMYP9LjFH1nkJVVbexD', 'yNVTM18qmFNBktGqtxKFli9xgDkichcjgfOicfyEeMjTc4EdR9blhTM14X2H', 'HKNoxdZgt0mRc1vKuuJ4J06LTfzFrxSOeXWazm92jqH60ofYrnJpAUvWx3L3', 'QV21QSgLRjNIQYlfp3OpYkqJcNEBWEBweGQQ9I1q22c2rc8otAbjs7MqFcTV', 'wK9Pztkryb9RhLB29J25ccWSu3RLvads6Q8T039aoJlQb0iB2P9mfaN6uliv', 'HnMlHzyYFkwda1FuphRZNHnw3WRCAlmGYihdC5xjH3ISX4ZbeAvt8nNT8gYw', 'w0NHNoVUyaAZPeRHPi0W5dAK4WqUsmmLcl1cGTMswGWfDmz800pmj2iYBL2c', 'yfqj3bbJq0sBowqtAh5Ma565il7sQLtQEQ6uAWnzxSWhvya1Pl6Al9ArOoWU', 'mk317UbueRKqoaLeU6QEOLcmSAnM1NGcbzqGTO6gKpX1zEoT5HX05W0L1Uoj'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Base64 encoded string: 'v9mb9RpVrBE7RDaZZSlVasGbjcVsh5usrfttbXqlgeJyDqdY7cTE2drMR17nvl52fHF5OTPzoyAD9uyH8hwJh9nnne6C', 'sTKUegd6TpziDRxcoIzFv0BJOXNElQ9ZIpYxUFoWs2pQcwvHZ8GRKK5vXXJQB73pBHiVBpX3NNRfjEw4DlGkkZJpqTmY', 'MSmlZMaIU7cagZJvS85lg9zJNBfmNadSV9rvEhajFn7HmNlf5RSq7LIlLR17d0zoxBYpAnlBElZRNKb6sY7PSUOwcgq8', 'iWTpiqA8Xj8vLbi8hQL7UiXhxxev7FsVcOX1my0mhYYIU13dVspHefR4O5juQz61r6JHgNgsqb4NdzBcwHhyyFrO0r8J', 'vHyY0aBSMHEExVeyJXpynUyqZuACd4VQp3WcOk5lh71s5GEdqr8SyBHquZeZXQB8RB5RugZhZmZrNiEBHtN5j38hUwjF', 'pyNITOUQ3ksF4wmIkok3A5BCeUcw8TVzDpWAy3h3bMYyG0v1JdAc47MnLUKAUmGwdDGE0u170UeE3EMZOKBNyQ1jEUfQ', 'X9wex5y9GnKMDDs2F07JPjvRFfUmBBwDgCT0g1B4MFHupra8FLjnPmrbMkiLeEYVwfdrK5CMwLjF6gbJpfkp6SPZOa5h'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	Base64 encoded string: 'pCqflRx1rdKp8BCVhngIhLeuZVYFpAcvMO6hjX5dIMKNl1gm9Q1Jgwr5sU2f4lpqQeqB97df83qBtJxCzv0U8DZWCo85'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, OPQSObGEdF.cs	Base64 encoded string: 'RMWzTVi3Qn2g0BNzSMsRPquCDIC9rga75Gk7iF91H0N9YKINnVoR3zLVkpsZxQ9ExYuWbEg2hz1FA5TZ3wWo2Y6P7uKR', 'nfpBNoNEeEqIg0AuRrroLcpbzjuosrtDMeYp3cOSkk03XFsfxifPWkeGzNgHPQbCpmZjCiIi2pJVZ3NOMSqRRhtvO08d', 'GqNK6Y1mMYvDVzVASSPOKqbpGIizl5M7kp0YF0qQn8kEq1wq25zMNhfIFjck90TbgZfHlzZx2sQRDXWc92hBHfZazCrk'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, AhV9cITdXv.cs	Base64 encoded string: 'Id2Rlq0bMyrMvmKMy9Hr0SpA7pjax9NcrH6ko5R6iNreT2VFvbpd8BUXaRJp'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, lwCMFX9W8i.cs	Base64 encoded string: 'YpChdJUzj78mlSIIrAPZg71blMMWyS4heKalax9ysig4rslGusL5UOBlg7hJ', 'KPrG7v6iToVv5eokwYpMDJoliNVPXMVCoPiq35deyGOLVbT0VPYgN4J3vJ3R', 'Kn3MjRnALfYYy88AxYxk50IbpqSQy8fk4L1KHkrKOBUCTPjlLcZDqyQIQD77', 'IZodmP7LUAI0C2Pom6YCorxLt8nFONEH3iXaHPHRIfkZNfeDdzKtkVLnZvkL', 'YA3PKorzoKQpSBINQLV4PbSaFrEoAAY0KYkhXXzBLlN88vZZakoWUF3dzCtq', 'RAvxA7r4GZOPoDyRiVX3GnmTjUlesViKv9uLXvJE4yRiPTRgwEdblPX2AwJI', 'tLpbn4h4dOia2QDYqaZRWDdF7zgdC0P2bCuNN5EwO5WaRgH50AqhWCICRm5S', 'QfetLAmJpkpRhQOOF8kDZI9jIWRrAfh7dKOJ2LFQrgf7ny7VmgYk6AcXEfhd'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, tiWHr4oL6x.cs	Base64 encoded string: 'H25jbxpjW25c0ZiUrQn1jcJHNJIsFSv9GY1VqM7tX8KvOYe9486CAsg8vGyj', 'xgxETpH56RuE3gfpYeTgQNPU6lWgTqszdVjtLZNq4M0kgNfoW4rCP0k1VshK'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, wHUoYuStNT.cs	Base64 encoded string: 'TSzKwKTH65Vvqq35exOuDv6wGfK054sDVjDg4Zu4yB1xRavxiDDPrmTL3HZs', 'hga8ivnVfNF4AFRYDS6Q0YkFgGbmCzHHTPEiOgt3xqAWHD0linjFE5lMr7Cm', 'lSIJI6jVWDk05FfmWqSYz2NXXF0k8dnDgbVMcHlyBc3vK5cIviESTDWCZ0Nb', 'ItLfVWSOgRIuDEX90nulHK3yKn1JIaxOAqL1rC1RaILoWPrHqVz6UvIrdSxS', 'o8ZvL2DDxYuFiF33pyB5gTOJQCtldFQAUncWA6Pm2VJYjm670TbflAKg4A1V', 'jn96YmXwqIuDgAyxjPnkx7fgGO1fgI7XmqwFXDqQp74ZPijTz7KWFUl02uYPDo9rmMYRU8612T2X8LiNb5XgZ6UcXAyA', 'kEAHdMshu3AJAZig6CpRM0yAiphVjJdgWYEmAD3iXQpKvCgnGasxDsp2JSq8dRSZAhXPT5FmXJuS42QnPamgSkDFxlmM', 'ptJkt6r8N0dirVrfyXBqLSo4op4zrOy1vzdybx0PKoIZFLQNgsYF8pQkhtfhKNkL4ULh1VBs2foV7B0FaEBkuSRGw5TW', 'MQKYhoqJT8yqqMZD5e3BGdbY26Priy1ve9MWFvzFKSCdrPvWTdVegFSccX8m5Cm5seZBhRzVidBZts9csSnniF1Is9PA', 'McPLR0iu5mC2jVkdtWEUo6sP6BRWKVSCVIy52Jjrj7OnK8CTv9PVVgY9ky13S5ZknyfXaVQZncy0b6CyzBeV9vruj6bX', 'UQnuQbFElcEKCGng7yYTf6V5CGLMFZAcZLOI82EPHDGhGWjkEB32Znj5UgThpSNrv1z3sM5V9eCcBrKBEN9RDnqWpU0t', 'q6O7Vlf3FrzMbmW3ahTqWmOxSgS1uN8JcMTFQ4jy6wkgTkXTcGuY0TamiqxYnssHSNQp0EFaH8Ib5reommrlTKhNjvyX', 'zb78JyDHMORsh2I1lsBkDCCHWoz5TSuenCS9r07r5GsUd7Wj2BdPC7yzZhxfwHpFlb7ZBsdHM4pBbZ3qmNSqbamKWRPd', 'qnlJfxaQoO7FjUT82yNTkMiMx8CkR1AekpVA0g2SPoWqgoXLvIDJOc0FYsaDxlOIlSbAB61sHiXPXXSufzV5wQNUGAma'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, Tg2SEP0VQY.cs	Base64 encoded string: 'SzRAGbZfRW87GpDPTl6mYEdbGfHmbd6JT8oXbLaCaPJUcaAsf9vKKT8j13Ll', 'Mmzvsz5iwN6SLMMKvoVq6bCvZ6zTLOGhh47HaUORTznXMf7m9KaaKbWOZAGC', 'oV4ybiASD8y8LfP6lpUhFYGdS5UnHdm9yChGpzgOKlWhOaCZGbW0YwwomZAG', 'Wzk43dKfG1Ppjd7Je6pU1IK3o32BGizMbgxzVDCLX7WuAfemwOMWLLtJoVQ8', 'xhJXDzNieJxeeUgR2BOUJPpCokeZ9qXSNCMZ6JfOKgEQh46uLI1q8gykPv1j', 'VRsFeUe66XUj0ePqNBTFK89VJLU9WOWbQ6i42016cF5JGYigEncqNA66SZUG', 'VXsWhjt6xyy5IYkdIw89Xr9PQnaI5oZrnBEurRSzdkMYP9LjFH1nkJVVbexD', 'yNVTM18qmFNBktGqtxKFli9xgDkichcjgfOicfyEeMjTc4EdR9blhTM14X2H', 'HKNoxdZgt0mRc1vKuuJ4J06LTfzFrxSOeXWazm92jqH60ofYrnJpAUvWx3L3', 'QV21QSgLRjNIQYlfp3OpYkqJcNEBWEBweGQQ9I1q22c2rc8otAbjs7MqFcTV', 'wK9Pztkryb9RhLB29J25ccWSu3RLvads6Q8T039aoJlQb0iB2P9mfaN6uliv', 'HnMlHzyYFkwda1FuphRZNHnw3WRCAlmGYihdC5xjH3ISX4ZbeAvt8nNT8gYw', 'w0NHNoVUyaAZPeRHPi0W5dAK4WqUsmmLcl1cGTMswGWfDmz800pmj2iYBL2c', 'yfqj3bbJq0sBowqtAh5Ma565il7sQLtQEQ6uAWnzxSWhvya1Pl6Al9ArOoWU', 'mk317UbueRKqoaLeU6QEOLcmSAnM1NGcbzqGTO6gKpX1zEoT5HX05W0L1Uoj'
Source: FluxusV1.2.2.dr, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	Base64 encoded string: 'v9mb9RpVrBE7RDaZZSlVasGbjcVsh5usrfttbXqlgeJyDqdY7cTE2drMR17nvl52fHF5OTPzoyAD9uyH8hwJh9nnne6C', 'sTKUegd6TpziDRxcoIzFv0BJOXNElQ9ZIpYxUFoWs2pQcwvHZ8GRKK5vXXJQB73pBHiVBpX3NNRfjEw4DlGkkZJpqTmY', 'MSmlZMaIU7cagZJvS85lg9zJNBfmNadSV9rvEhajFn7HmNlf5RSq7LIlLR17d0zoxBYpAnlBElZRNKb6sY7PSUOwcgq8', 'iWTpiqA8Xj8vLbi8hQL7UiXhxxev7FsVcOX1my0mhYYIU13dVspHefR4O5juQz61r6JHgNgsqb4NdzBcwHhyyFrO0r8J', 'vHyY0aBSMHEExVeyJXpynUyqZuACd4VQp3WcOk5lh71s5GEdqr8SyBHquZeZXQB8RB5RugZhZmZrNiEBHtN5j38hUwjF', 'pyNITOUQ3ksF4wmIkok3A5BCeUcw8TVzDpWAy3h3bMYyG0v1JdAc47MnLUKAUmGwdDGE0u170UeE3EMZOKBNyQ1jEUfQ', 'X9wex5y9GnKMDDs2F07JPjvRFfUmBBwDgCT0g1B4MFHupra8FLjnPmrbMkiLeEYVwfdrK5CMwLjF6gbJpfkp6SPZOa5h'
Source: FluxusV1.2.2.dr, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	Base64 encoded string: 'pCqflRx1rdKp8BCVhngIhLeuZVYFpAcvMO6hjX5dIMKNl1gm9Q1Jgwr5sU2f4lpqQeqB97df83qBtJxCzv0U8DZWCo85'
Source: FluxusV1.2.2.dr, OPQSObGEdF.cs	Base64 encoded string: 'RMWzTVi3Qn2g0BNzSMsRPquCDIC9rga75Gk7iF91H0N9YKINnVoR3zLVkpsZxQ9ExYuWbEg2hz1FA5TZ3wWo2Y6P7uKR', 'nfpBNoNEeEqIg0AuRrroLcpbzjuosrtDMeYp3cOSkk03XFsfxifPWkeGzNgHPQbCpmZjCiIi2pJVZ3NOMSqRRhtvO08d', 'GqNK6Y1mMYvDVzVASSPOKqbpGIizl5M7kp0YF0qQn8kEq1wq25zMNhfIFjck90TbgZfHlzZx2sQRDXWc92hBHfZazCrk'
Source: FluxusV1.2.2.dr, AhV9cITdXv.cs	Base64 encoded string: 'Id2Rlq0bMyrMvmKMy9Hr0SpA7pjax9NcrH6ko5R6iNreT2VFvbpd8BUXaRJp'
Source: FluxusV1.2.2.dr, lwCMFX9W8i.cs	Base64 encoded string: 'YpChdJUzj78mlSIIrAPZg71blMMWyS4heKalax9ysig4rslGusL5UOBlg7hJ', 'KPrG7v6iToVv5eokwYpMDJoliNVPXMVCoPiq35deyGOLVbT0VPYgN4J3vJ3R', 'Kn3MjRnALfYYy88AxYxk50IbpqSQy8fk4L1KHkrKOBUCTPjlLcZDqyQIQD77', 'IZodmP7LUAI0C2Pom6YCorxLt8nFONEH3iXaHPHRIfkZNfeDdzKtkVLnZvkL', 'YA3PKorzoKQpSBINQLV4PbSaFrEoAAY0KYkhXXzBLlN88vZZakoWUF3dzCtq', 'RAvxA7r4GZOPoDyRiVX3GnmTjUlesViKv9uLXvJE4yRiPTRgwEdblPX2AwJI', 'tLpbn4h4dOia2QDYqaZRWDdF7zgdC0P2bCuNN5EwO5WaRgH50AqhWCICRm5S', 'QfetLAmJpkpRhQOOF8kDZI9jIWRrAfh7dKOJ2LFQrgf7ny7VmgYk6AcXEfhd'
Source: FluxusV1.2.2.dr, tiWHr4oL6x.cs	Base64 encoded string: 'H25jbxpjW25c0ZiUrQn1jcJHNJIsFSv9GY1VqM7tX8KvOYe9486CAsg8vGyj', 'xgxETpH56RuE3gfpYeTgQNPU6lWgTqszdVjtLZNq4M0kgNfoW4rCP0k1VshK'
Source: FluxusV1.2.2.dr, wHUoYuStNT.cs	Base64 encoded string: 'TSzKwKTH65Vvqq35exOuDv6wGfK054sDVjDg4Zu4yB1xRavxiDDPrmTL3HZs', 'hga8ivnVfNF4AFRYDS6Q0YkFgGbmCzHHTPEiOgt3xqAWHD0linjFE5lMr7Cm', 'lSIJI6jVWDk05FfmWqSYz2NXXF0k8dnDgbVMcHlyBc3vK5cIviESTDWCZ0Nb', 'ItLfVWSOgRIuDEX90nulHK3yKn1JIaxOAqL1rC1RaILoWPrHqVz6UvIrdSxS', 'o8ZvL2DDxYuFiF33pyB5gTOJQCtldFQAUncWA6Pm2VJYjm670TbflAKg4A1V', 'jn96YmXwqIuDgAyxjPnkx7fgGO1fgI7XmqwFXDqQp74ZPijTz7KWFUl02uYPDo9rmMYRU8612T2X8LiNb5XgZ6UcXAyA', 'kEAHdMshu3AJAZig6CpRM0yAiphVjJdgWYEmAD3iXQpKvCgnGasxDsp2JSq8dRSZAhXPT5FmXJuS42QnPamgSkDFxlmM', 'ptJkt6r8N0dirVrfyXBqLSo4op4zrOy1vzdybx0PKoIZFLQNgsYF8pQkhtfhKNkL4ULh1VBs2foV7B0FaEBkuSRGw5TW', 'MQKYhoqJT8yqqMZD5e3BGdbY26Priy1ve9MWFvzFKSCdrPvWTdVegFSccX8m5Cm5seZBhRzVidBZts9csSnniF1Is9PA', 'McPLR0iu5mC2jVkdtWEUo6sP6BRWKVSCVIy52Jjrj7OnK8CTv9PVVgY9ky13S5ZknyfXaVQZncy0b6CyzBeV9vruj6bX', 'UQnuQbFElcEKCGng7yYTf6V5CGLMFZAcZLOI82EPHDGhGWjkEB32Znj5UgThpSNrv1z3sM5V9eCcBrKBEN9RDnqWpU0t', 'q6O7Vlf3FrzMbmW3ahTqWmOxSgS1uN8JcMTFQ4jy6wkgTkXTcGuY0TamiqxYnssHSNQp0EFaH8Ib5reommrlTKhNjvyX', 'zb78JyDHMORsh2I1lsBkDCCHWoz5TSuenCS9r07r5GsUd7Wj2BdPC7yzZhxfwHpFlb7ZBsdHM4pBbZ3qmNSqbamKWRPd', 'qnlJfxaQoO7FjUT82yNTkMiMx8CkR1AekpVA0g2SPoWqgoXLvIDJOc0FYsaDxlOIlSbAB61sHiXPXXSufzV5wQNUGAma'
Source: FluxusV1.2.2.dr, Tg2SEP0VQY.cs	Base64 encoded string: 'SzRAGbZfRW87GpDPTl6mYEdbGfHmbd6JT8oXbLaCaPJUcaAsf9vKKT8j13Ll', 'Mmzvsz5iwN6SLMMKvoVq6bCvZ6zTLOGhh47HaUORTznXMf7m9KaaKbWOZAGC', 'oV4ybiASD8y8LfP6lpUhFYGdS5UnHdm9yChGpzgOKlWhOaCZGbW0YwwomZAG', 'Wzk43dKfG1Ppjd7Je6pU1IK3o32BGizMbgxzVDCLX7WuAfemwOMWLLtJoVQ8', 'xhJXDzNieJxeeUgR2BOUJPpCokeZ9qXSNCMZ6JfOKgEQh46uLI1q8gykPv1j', 'VRsFeUe66XUj0ePqNBTFK89VJLU9WOWbQ6i42016cF5JGYigEncqNA66SZUG', 'VXsWhjt6xyy5IYkdIw89Xr9PQnaI5oZrnBEurRSzdkMYP9LjFH1nkJVVbexD', 'yNVTM18qmFNBktGqtxKFli9xgDkichcjgfOicfyEeMjTc4EdR9blhTM14X2H', 'HKNoxdZgt0mRc1vKuuJ4J06LTfzFrxSOeXWazm92jqH60ofYrnJpAUvWx3L3', 'QV21QSgLRjNIQYlfp3OpYkqJcNEBWEBweGQQ9I1q22c2rc8otAbjs7MqFcTV', 'wK9Pztkryb9RhLB29J25ccWSu3RLvads6Q8T039aoJlQb0iB2P9mfaN6uliv', 'HnMlHzyYFkwda1FuphRZNHnw3WRCAlmGYihdC5xjH3ISX4ZbeAvt8nNT8gYw', 'w0NHNoVUyaAZPeRHPi0W5dAK4WqUsmmLcl1cGTMswGWfDmz800pmj2iYBL2c', 'yfqj3bbJq0sBowqtAh5Ma565il7sQLtQEQ6uAWnzxSWhvya1Pl6Al9ArOoWU', 'mk317UbueRKqoaLeU6QEOLcmSAnM1NGcbzqGTO6gKpX1zEoT5HX05W0L1Uoj'

Source: FluxusV1.2.2.dr, Tg2SEP0VQY.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: FluxusV1.2.2.dr, Tg2SEP0VQY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: XClient.exe.0.dr, Tg2SEP0VQY.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XClient.exe.0.dr, Tg2SEP0VQY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, Tg2SEP0VQY.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, Tg2SEP0VQY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, Tg2SEP0VQY.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, Tg2SEP0VQY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@22/13@4/5

Source: C:\Users\user\Desktop\IM3OLcx7li.exe

File created: C:\Users\user\AppData\Roaming\XClient.exe

Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Mutant created: \Sessions\1\BaseNamedObjects\I32nKqSRzWhs8X6jy
Source: C:\Users\user\AppData\Roaming\XClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\mrQwLieiU5CPBIXL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3344:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7616

Source: C:\Users\user\AppData\Roaming\XClient.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Source: IM3OLcx7li.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: IM3OLcx7li.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\IM3OLcx7li.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\IM3OLcx7li.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: IM3OLcx7li.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\IM3OLcx7li.exe "C:\Users\user\Desktop\IM3OLcx7li.exe"
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process created: C:\Users\user\AppData\Roaming\Bootstrapper.exe "C:\Users\user\AppData\Roaming\Bootstrapper.exe"
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FluxusV1" /tr "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7616 -s 2192
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process created: C:\Users\user\AppData\Roaming\Bootstrapper.exe "C:\Users\user\AppData\Roaming\Bootstrapper.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FluxusV1" /tr "C:\Users\user\AppData\Roaming\FluxusV1.2"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior

Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll

Source: C:\Users\user\Desktop\IM3OLcx7li.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: FluxusV1.lnk.2.dr

LNK file: ..\..\..\..\..\FluxusV1.2

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\IM3OLcx7li.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: IM3OLcx7li.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: IM3OLcx7li.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: m.pdbL source: Bootstrapper.exe, 00000003.00000002.1606384666.0000026C3E970000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.pdbq source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.ni.pdbRSDS source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: Bootstrapper.exe, 00000003.00000002.1604700477.0000026C263BD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Data.ni.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.pdb source: Bootstrapper.exe, 00000003.00000002.1604700477.0000026C263BD000.00000004.00000800.00020000.00000000.sdmp, WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Data.pdbH source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Numerics.ni.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: mscorlib.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: mscorlib.ni.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Core.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.pdbp source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\System.pdbm source: Bootstrapper.exe, 00000003.00000002.1606384666.0000026C3E952000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Numerics.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.ni.pdb source: WERBD56.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERBD56.tmp.dmp.14.dr

Data Obfuscation

Source: XClient.exe.0.dr, lwCMFX9W8i.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{IPxnaeCqqP.v97gofGop8,IPxnaeCqqP._2K51bvSoES,IPxnaeCqqP.A8uXmUk0jQ,IPxnaeCqqP._4RLVsYH0YO,BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.b3zl4uRwwY6ukR7b6bzhUvW0EySBBzqEzmRW5goEyh()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.0.dr, lwCMFX9W8i.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Kvi3w5OZF2[2],BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2._8lDetZwdnyadMSUexUYebaovugM37JspOQsiO2VXlD(Convert.FromBase64String(Kvi3w5OZF2[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, lwCMFX9W8i.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{IPxnaeCqqP.v97gofGop8,IPxnaeCqqP._2K51bvSoES,IPxnaeCqqP.A8uXmUk0jQ,IPxnaeCqqP._4RLVsYH0YO,BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.b3zl4uRwwY6ukR7b6bzhUvW0EySBBzqEzmRW5goEyh()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, lwCMFX9W8i.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Kvi3w5OZF2[2],BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2._8lDetZwdnyadMSUexUYebaovugM37JspOQsiO2VXlD(Convert.FromBase64String(Kvi3w5OZF2[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, lwCMFX9W8i.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{IPxnaeCqqP.v97gofGop8,IPxnaeCqqP._2K51bvSoES,IPxnaeCqqP.A8uXmUk0jQ,IPxnaeCqqP._4RLVsYH0YO,BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.b3zl4uRwwY6ukR7b6bzhUvW0EySBBzqEzmRW5goEyh()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, lwCMFX9W8i.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Kvi3w5OZF2[2],BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2._8lDetZwdnyadMSUexUYebaovugM37JspOQsiO2VXlD(Convert.FromBase64String(Kvi3w5OZF2[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: FluxusV1.2.2.dr, lwCMFX9W8i.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{IPxnaeCqqP.v97gofGop8,IPxnaeCqqP._2K51bvSoES,IPxnaeCqqP.A8uXmUk0jQ,IPxnaeCqqP._4RLVsYH0YO,BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.b3zl4uRwwY6ukR7b6bzhUvW0EySBBzqEzmRW5goEyh()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: FluxusV1.2.2.dr, lwCMFX9W8i.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Kvi3w5OZF2[2],BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2._8lDetZwdnyadMSUexUYebaovugM37JspOQsiO2VXlD(Convert.FromBase64String(Kvi3w5OZF2[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: XClient.exe.0.dr, lwCMFX9W8i.cs	.Net Code: _2VoyIVV9D3 System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, lwCMFX9W8i.cs	.Net Code: TInrtXcXfH System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, lwCMFX9W8i.cs	.Net Code: TInrtXcXfH
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, lwCMFX9W8i.cs	.Net Code: _2VoyIVV9D3 System.AppDomain.Load(byte[])
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, lwCMFX9W8i.cs	.Net Code: TInrtXcXfH System.AppDomain.Load(byte[])
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, lwCMFX9W8i.cs	.Net Code: TInrtXcXfH
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, lwCMFX9W8i.cs	.Net Code: _2VoyIVV9D3 System.AppDomain.Load(byte[])
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, lwCMFX9W8i.cs	.Net Code: TInrtXcXfH System.AppDomain.Load(byte[])
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, lwCMFX9W8i.cs	.Net Code: TInrtXcXfH
Source: FluxusV1.2.2.dr, lwCMFX9W8i.cs	.Net Code: _2VoyIVV9D3 System.AppDomain.Load(byte[])
Source: FluxusV1.2.2.dr, lwCMFX9W8i.cs	.Net Code: TInrtXcXfH System.AppDomain.Load(byte[])
Source: FluxusV1.2.2.dr, lwCMFX9W8i.cs	.Net Code: TInrtXcXfH

Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Code function: 0_2_00007FFB4B0400BD pushad ; iretd	0_2_00007FFB4B0400C1
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFB4B062CAD push E95AF54Fh; ret	2_2_00007FFB4B062D79
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFB4B0600BD pushad ; iretd	2_2_00007FFB4B0600C1
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFB4B06253D push E95DA13Bh; retf	2_2_00007FFB4B062589
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Code function: 3_2_00007FFB4B06D668 push ss; retf	3_2_00007FFB4B06D837
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Code function: 3_2_00007FFB4B06A272 push ebx; retf	3_2_00007FFB4B06A282
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Code function: 3_2_00007FFB4B0500BD pushad ; iretd	3_2_00007FFB4B0500C1

Source: IM3OLcx7li.exe

Static PE information: section name: .text entropy: 7.997895898511622

Source: IM3OLcx7li.exe, 2vQWjXXJimRWbe79pCEPet6wDiJk73.cs	High entropy of concatenated method names: '_7K3A5VH6nvC96kiWeqa2dEPS7Lyiar', 'vEc3phBV0xTGPymHbsnf8Jp6CdqH5N', 'wFypMbbeJPaHTLGbEbp6TXaqiu4GTi', 'zy34NsEwZSTfRBRVYkgMz8fMVuGPQJ', 'ZpbTJXMaJBpyDJQCSx43xH43X7bauP', 'PizAeFhfRLK6ruDaejixbdwr0fNd7f', 'I9IJteLd20TRgmY3ZZ6Q5zOCTbg44N', 'Hbb7xdrnXU1NRn7GifkpuprdagsCig', 'nujBmSsf3Y4DzpdseUwCOz3iyzvgHu', 'xJEj6MNlvukW5WHSInQ3N1xTSlVyrC'
Source: IM3OLcx7li.exe, RjlBKnJ82IkA1hZF7RVGlb1CXo9XQL22AAU4jSsKnOTSeRZr8rlLtRsECJ2ul70G9kNoejElNqoG6CBFgoVY6i08.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'aDEDaq1xkOkD1evi8zBws4VoFmGWFy', '_5lasQrdv5DF7KJDqiMte3r7d9eLn7d', 'YpafLBVZ6cjWWkTTi6fBaazkQ8fD0j', 'XB0mXGHojzurglzwU6wY16kpsVO9AY'
Source: XClient.exe.0.dr, tcUBuJyp0kuY1K9nNfoDVKWb3Y2iLNMkOSt18PAfuw.cs	High entropy of concatenated method names: '_78AiBUnam0GXHIT2bUMaKPAPIxPeU3UzjHu1oVTBil', 'S5EqkR7mqWtZ6a5IDp7TyK6CW3zUveXII7p6hex5lf', '_74w4J0jQDQeaRheGhODj7J1orXj4aECV0HLwttilZo', 'jDQGzjrRie4pj7FGNp4hm5dA5PzQfrv1DC', 'gzkt1ZlpKxQH7e4CLzdmKnsGr0Kmr4Ho1Q', 'EJDoh3Fp8n9GMS1oujFXICK3NrYzvmKh0N', 'vOAEQwOFwYSdQUK0FVtj1aKcE6b5N8Au1s', 'NDYjrCSkmSWsEp4NPUsRvzWoqafPR5ZG8I', 'bmyc4xo5965cxDCPFgLgx5JY70onYeDK09', 'EXF47bzkH5BvDNhPHWf85AlU9CYbDjoNIZ'
Source: XClient.exe.0.dr, IPxnaeCqqP.cs	High entropy of concatenated method names: 'kpOZ4Lt4gwgG6jEol4HErnvw3jlMytzzSEomBshznzBJFIbGZTAkLj08A5mEy3u7GX3vJ7ITpZv', 'XgYRkUjXMkKuRfYYgwrHeeyxxxx3GARfl4k2nt4TXKJFY0CueIhIZwTeZJVQab1GUIwiEddVsDm', 'dCKcADEnm1pgzEZ5NF2thGG6DPKmDQv4IuI1FfjvArWHP1gQ6ujRNDpOx6cz6DA7sO1CsCud5D5', 'N8pW5VnFzT01TiSEcaePj6duYoBWruMXXWHmpX4fEZXMLwpvNaghyN3r4sf8CByvMW8UUdFhXQX'
Source: XClient.exe.0.dr, T2rJptLwPG.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'J5IuNcupU83hvhiYvCxejrODgOXDKiIt7Wo8MFlP3YlHZS0AOgnpUtSpXbu6WtrvinKESr8PxuB', 'iCGZZL3rRFfoAbUpnBPykINaEAIVpbYZaPiQp2G45DCXM4m4yAEGHVf13HLiz1sfTN9cKa5Shcb', 'LnzIZCzISJljIBEHkkvvj5TVblFTJjCsy62eN2gaaDhcbXJW99vBTe6eop1mKmh97mZdQz5zd7Y', 'zc25bB6Wlur92PeZxEqWzpDfU0k2b4mb1pNeTVqJyxsykZ43HoPI4Fjkakif7N0lC0occwwDgEv'
Source: XClient.exe.0.dr, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	High entropy of concatenated method names: '_2EqnGlerJ95QK3dN35ozNwI92clP197L7qaRx4MDix', 'M3end8FIGZ4KT9P4OIrkI7lOY6uefbu1knvCiaLTQZ', 'UB86svJ6sgtJNB4AX0IWib65Z7cmqCtOCG5soF6aQE', 'WavXTkBJsA5bacGyLGwWX8bYuUY8HnU31HV7GzkR1x', 'm8FIqM5LYq2Y7u9ojLyVPnZIfEQU88ZNPNfut9nSco', 'NyR9EmAuCCsrvWQ2lS4ldaRaqXBCTYvod4gLhwfRCV', 'mvmTNdUQ0549BZn400UDatdRrwzfXd0cRQ1mmtRptI', 'eoarsbfcp1vPsD4LkP3IV1J6LH32YSojYKOBlcjB96', 'htrsTOU8XXNN899rADQLEIjZWCoQ9KkC03317eVYu3', 'c1FnzvrNrNJHwStR1vWzpcERrsPMA1JM6ryRFHarKc'
Source: XClient.exe.0.dr, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	High entropy of concatenated method names: '_4waLpMAEzWeRir3qWytT5PnoT1PSwwTtuxqYfoZyd1', '_5ZjYoZLsOvyaZnbzfGGrtQwo9hC0G6TOBapJUiPH6xMp2E8MC392OfI9CeHhdSJ8Ky2okhTvjf6BUJdUUn2pqdKeIfz4', '_0jFaZDkAojeMl3nP3zTPKOpbOk1CtRPnKqpDdZMTyiUMoao9E5PErOa20Cl0qVdxVGSheOiCLJRCjsxomRPIWeueIqBg', 's7C7nFoNrPXr2q7svwhZVbdnj6n97gS3myIPXuYNBdZZpsbhxG08ymk9tFGUk2zTIb0bFVJGMrtARtQNBnNX7lo1C5ZB', 'oiJ1zkP8qZe40ZQ5d6zU6mKGGHiMmy78gP2EFcctnwnFFHACJOQXOQsGclrcs1ruQHwj2SOYuYY93Dt9Y5d5j9DCOcMS'
Source: XClient.exe.0.dr, OPQSObGEdF.cs	High entropy of concatenated method names: 'nLxMkeOnhK', 'RrCIK2qlvps70cb2JD1lTEMJ09kzPxMTokjndb2YUg', 'EtzlqS3tZnwyUpZBJiMJhkmGhlpIgvnw0tWIpUToRK', 'fyKZSWca3YMdQ3kwNZe7sRlLHTPvnfDvnovTVKJVJo', 'GwaTytUCxvQPOK34A5vtH3rATveCM4blqOT4NbHhDn8lB62M6Z2OPnTz0LrlHn05MBRuZdr9XWEFhwC8LEC9KOXBWxXL', 'RId9W2xGdGQqJEAQ3oYj2A0IfHcdf3R8CKnHeGPjoLbtkDq2SeLTGjhYmF3U3zmw1kuwfFUWAKFVMgcgnz9wYoIsYD0C', 'IoJCdaApHn7iNflgF4clCmWKyCkzMKB5maKWfmCt1R6Dtr1uEuT7yQqJsy4s3t9VxBiTr0ZYzei0iSYBup8ZBJxPAOJJ', '_3TH0r03vlIN10OAfgMsthv96KEIC0woj09b5bKAQVuOHZht39AafLFzsAEV1Foz4v7vq8gQZ9Tp5HSIMarSTbVBqRlCS', 'YXAG4k8tLMvVT9gW7Dmy24WKjHpWUUTSlKj2lB9I15dvtzVvuNg0BUuk5FsqtZpBwswINpzgh5SfKed3NfVrntTxfe79', 'UuZlKO76R6ZxpWqCSkFtb7bxuSKMtyCkazEFfLs6zOXKrFjQ1xuPhmazxwJRujFetS6T1W5ev2krq7gex46QwhgKBHrw'
Source: XClient.exe.0.dr, AhV9cITdXv.cs	High entropy of concatenated method names: 'o66L9pVmf6', 'F2L0T4ReRRIYxR6AV87g98WDezmBJKQMtYCUBrolWftJxApx1vdZy6cDOTBM', 'eEHGXaV3WChdB3RyVXydCxEyQ3QZHz1FJxnbQcJJ0mQxHVKFaq8gDsvyynon', 'Hn4JvYR4SN1pAM9mzmo6W75hN9b4ZTwnLkopcGIfcSgeu0VDg52rKwo91WSK', 'RDIH21FTGzFpOsa7QsLwTAglGPOYNnaFxRK1xZ4c3cZckHXWYk6HR4ap37v7'
Source: XClient.exe.0.dr, lwCMFX9W8i.cs	High entropy of concatenated method names: 'SqZ5p8959e', '_2VoyIVV9D3', '_0RRX4Y5ycE', 'VcfrjE5JxA', '_1AmYyyaDVS', 'ugEYsiFbng', 'VBsPu5NYEX', 'iw5eT8lnQx', 'fZztcJinWH', 'yBH6HZQOkT'
Source: XClient.exe.0.dr, tiWHr4oL6x.cs	High entropy of concatenated method names: 'BBCX1lsSLM', 'ZWeRD6vsad', 'qrar9acQxn', 'whhd0lUifU', '_1GwOXv9cI0JjJShOAumvZeKIpwFKr3qvLhRmRNE6l1W3bvOR8FsQJTjCjjiQ9OsPk0ZjreRnQC3', 'PLOU9UQCsvkN6CG2GzHRlW4OqPPakakwEe5Sj6qhWK1vviqWNrGJYuSGqAwo', 'WRjWOmJZYIVxPkp79zEy6DDpqgo5xM5gaFx6PckgCrsKtorwYvuS2Pj99EUc', '_2bOmzBFS7qG56yPgkL6vb4D9U0YWqsNkhddZsZoQK3HsBmwNgdiurVp8reWB', 'cOI1T4oDoT6aTxDIzHQC6f3eGQ88GazQDbgmUmgStJxEuZwlqh4hU0F5fDOB', 'IINVuPw0fslgm8QAlbADV1iMx4mGNaJS9G6gLPgQMAwDnMpSLuGYcrI3Ural'
Source: XClient.exe.0.dr, wHUoYuStNT.cs	High entropy of concatenated method names: 'gKavcLYxB2', 'Ysj6ITnkWo', 'BWogeR5NM0', 'aNLHHkHuTj', '_94irga28Sf', 'pYvsbJzF9x', 'Q1VPVic2ED', 'EpVhXBCX0T', 'MJnGzoScGj', 'iJbM0C3tUS'
Source: XClient.exe.0.dr, Tg2SEP0VQY.cs	High entropy of concatenated method names: '_7lJn1gsbhw', 'gwfwc4IgTH', 'niAJutz802', 'Hg5bc2RT5N', 'GcJ7OYHwP7', 'ocfBZU5brU', 'FUZFHDznAL', 'gubihUXUoM', 'nYGikdb4Tx', 'C5DdPW80RG'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, tcUBuJyp0kuY1K9nNfoDVKWb3Y2iLNMkOSt18PAfuw.cs	High entropy of concatenated method names: '_78AiBUnam0GXHIT2bUMaKPAPIxPeU3UzjHu1oVTBil', 'S5EqkR7mqWtZ6a5IDp7TyK6CW3zUveXII7p6hex5lf', '_74w4J0jQDQeaRheGhODj7J1orXj4aECV0HLwttilZo', 'jDQGzjrRie4pj7FGNp4hm5dA5PzQfrv1DC', 'gzkt1ZlpKxQH7e4CLzdmKnsGr0Kmr4Ho1Q', 'EJDoh3Fp8n9GMS1oujFXICK3NrYzvmKh0N', 'vOAEQwOFwYSdQUK0FVtj1aKcE6b5N8Au1s', 'NDYjrCSkmSWsEp4NPUsRvzWoqafPR5ZG8I', 'bmyc4xo5965cxDCPFgLgx5JY70onYeDK09', 'EXF47bzkH5BvDNhPHWf85AlU9CYbDjoNIZ'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, IPxnaeCqqP.cs	High entropy of concatenated method names: 'kpOZ4Lt4gwgG6jEol4HErnvw3jlMytzzSEomBshznzBJFIbGZTAkLj08A5mEy3u7GX3vJ7ITpZv', 'XgYRkUjXMkKuRfYYgwrHeeyxxxx3GARfl4k2nt4TXKJFY0CueIhIZwTeZJVQab1GUIwiEddVsDm', 'dCKcADEnm1pgzEZ5NF2thGG6DPKmDQv4IuI1FfjvArWHP1gQ6ujRNDpOx6cz6DA7sO1CsCud5D5', 'N8pW5VnFzT01TiSEcaePj6duYoBWruMXXWHmpX4fEZXMLwpvNaghyN3r4sf8CByvMW8UUdFhXQX'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, T2rJptLwPG.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'J5IuNcupU83hvhiYvCxejrODgOXDKiIt7Wo8MFlP3YlHZS0AOgnpUtSpXbu6WtrvinKESr8PxuB', 'iCGZZL3rRFfoAbUpnBPykINaEAIVpbYZaPiQp2G45DCXM4m4yAEGHVf13HLiz1sfTN9cKa5Shcb', 'LnzIZCzISJljIBEHkkvvj5TVblFTJjCsy62eN2gaaDhcbXJW99vBTe6eop1mKmh97mZdQz5zd7Y', 'zc25bB6Wlur92PeZxEqWzpDfU0k2b4mb1pNeTVqJyxsykZ43HoPI4Fjkakif7N0lC0occwwDgEv'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	High entropy of concatenated method names: '_2EqnGlerJ95QK3dN35ozNwI92clP197L7qaRx4MDix', 'M3end8FIGZ4KT9P4OIrkI7lOY6uefbu1knvCiaLTQZ', 'UB86svJ6sgtJNB4AX0IWib65Z7cmqCtOCG5soF6aQE', 'WavXTkBJsA5bacGyLGwWX8bYuUY8HnU31HV7GzkR1x', 'm8FIqM5LYq2Y7u9ojLyVPnZIfEQU88ZNPNfut9nSco', 'NyR9EmAuCCsrvWQ2lS4ldaRaqXBCTYvod4gLhwfRCV', 'mvmTNdUQ0549BZn400UDatdRrwzfXd0cRQ1mmtRptI', 'eoarsbfcp1vPsD4LkP3IV1J6LH32YSojYKOBlcjB96', 'htrsTOU8XXNN899rADQLEIjZWCoQ9KkC03317eVYu3', 'c1FnzvrNrNJHwStR1vWzpcERrsPMA1JM6ryRFHarKc'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	High entropy of concatenated method names: '_4waLpMAEzWeRir3qWytT5PnoT1PSwwTtuxqYfoZyd1', '_5ZjYoZLsOvyaZnbzfGGrtQwo9hC0G6TOBapJUiPH6xMp2E8MC392OfI9CeHhdSJ8Ky2okhTvjf6BUJdUUn2pqdKeIfz4', '_0jFaZDkAojeMl3nP3zTPKOpbOk1CtRPnKqpDdZMTyiUMoao9E5PErOa20Cl0qVdxVGSheOiCLJRCjsxomRPIWeueIqBg', 's7C7nFoNrPXr2q7svwhZVbdnj6n97gS3myIPXuYNBdZZpsbhxG08ymk9tFGUk2zTIb0bFVJGMrtARtQNBnNX7lo1C5ZB', 'oiJ1zkP8qZe40ZQ5d6zU6mKGGHiMmy78gP2EFcctnwnFFHACJOQXOQsGclrcs1ruQHwj2SOYuYY93Dt9Y5d5j9DCOcMS'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, OPQSObGEdF.cs	High entropy of concatenated method names: 'nLxMkeOnhK', 'RrCIK2qlvps70cb2JD1lTEMJ09kzPxMTokjndb2YUg', 'EtzlqS3tZnwyUpZBJiMJhkmGhlpIgvnw0tWIpUToRK', 'fyKZSWca3YMdQ3kwNZe7sRlLHTPvnfDvnovTVKJVJo', 'GwaTytUCxvQPOK34A5vtH3rATveCM4blqOT4NbHhDn8lB62M6Z2OPnTz0LrlHn05MBRuZdr9XWEFhwC8LEC9KOXBWxXL', 'RId9W2xGdGQqJEAQ3oYj2A0IfHcdf3R8CKnHeGPjoLbtkDq2SeLTGjhYmF3U3zmw1kuwfFUWAKFVMgcgnz9wYoIsYD0C', 'IoJCdaApHn7iNflgF4clCmWKyCkzMKB5maKWfmCt1R6Dtr1uEuT7yQqJsy4s3t9VxBiTr0ZYzei0iSYBup8ZBJxPAOJJ', '_3TH0r03vlIN10OAfgMsthv96KEIC0woj09b5bKAQVuOHZht39AafLFzsAEV1Foz4v7vq8gQZ9Tp5HSIMarSTbVBqRlCS', 'YXAG4k8tLMvVT9gW7Dmy24WKjHpWUUTSlKj2lB9I15dvtzVvuNg0BUuk5FsqtZpBwswINpzgh5SfKed3NfVrntTxfe79', 'UuZlKO76R6ZxpWqCSkFtb7bxuSKMtyCkazEFfLs6zOXKrFjQ1xuPhmazxwJRujFetS6T1W5ev2krq7gex46QwhgKBHrw'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, AhV9cITdXv.cs	High entropy of concatenated method names: 'o66L9pVmf6', 'F2L0T4ReRRIYxR6AV87g98WDezmBJKQMtYCUBrolWftJxApx1vdZy6cDOTBM', 'eEHGXaV3WChdB3RyVXydCxEyQ3QZHz1FJxnbQcJJ0mQxHVKFaq8gDsvyynon', 'Hn4JvYR4SN1pAM9mzmo6W75hN9b4ZTwnLkopcGIfcSgeu0VDg52rKwo91WSK', 'RDIH21FTGzFpOsa7QsLwTAglGPOYNnaFxRK1xZ4c3cZckHXWYk6HR4ap37v7'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, lwCMFX9W8i.cs	High entropy of concatenated method names: 'SqZ5p8959e', '_2VoyIVV9D3', '_0RRX4Y5ycE', 'VcfrjE5JxA', '_1AmYyyaDVS', 'ugEYsiFbng', 'VBsPu5NYEX', 'iw5eT8lnQx', 'fZztcJinWH', 'yBH6HZQOkT'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, tiWHr4oL6x.cs	High entropy of concatenated method names: 'BBCX1lsSLM', 'ZWeRD6vsad', 'qrar9acQxn', 'whhd0lUifU', '_1GwOXv9cI0JjJShOAumvZeKIpwFKr3qvLhRmRNE6l1W3bvOR8FsQJTjCjjiQ9OsPk0ZjreRnQC3', 'PLOU9UQCsvkN6CG2GzHRlW4OqPPakakwEe5Sj6qhWK1vviqWNrGJYuSGqAwo', 'WRjWOmJZYIVxPkp79zEy6DDpqgo5xM5gaFx6PckgCrsKtorwYvuS2Pj99EUc', '_2bOmzBFS7qG56yPgkL6vb4D9U0YWqsNkhddZsZoQK3HsBmwNgdiurVp8reWB', 'cOI1T4oDoT6aTxDIzHQC6f3eGQ88GazQDbgmUmgStJxEuZwlqh4hU0F5fDOB', 'IINVuPw0fslgm8QAlbADV1iMx4mGNaJS9G6gLPgQMAwDnMpSLuGYcrI3Ural'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, wHUoYuStNT.cs	High entropy of concatenated method names: 'gKavcLYxB2', 'Ysj6ITnkWo', 'BWogeR5NM0', 'aNLHHkHuTj', '_94irga28Sf', 'pYvsbJzF9x', 'Q1VPVic2ED', 'EpVhXBCX0T', 'MJnGzoScGj', 'iJbM0C3tUS'
Source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, Tg2SEP0VQY.cs	High entropy of concatenated method names: '_7lJn1gsbhw', 'gwfwc4IgTH', 'niAJutz802', 'Hg5bc2RT5N', 'GcJ7OYHwP7', 'ocfBZU5brU', 'FUZFHDznAL', 'gubihUXUoM', 'nYGikdb4Tx', 'C5DdPW80RG'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, tcUBuJyp0kuY1K9nNfoDVKWb3Y2iLNMkOSt18PAfuw.cs	High entropy of concatenated method names: '_78AiBUnam0GXHIT2bUMaKPAPIxPeU3UzjHu1oVTBil', 'S5EqkR7mqWtZ6a5IDp7TyK6CW3zUveXII7p6hex5lf', '_74w4J0jQDQeaRheGhODj7J1orXj4aECV0HLwttilZo', 'jDQGzjrRie4pj7FGNp4hm5dA5PzQfrv1DC', 'gzkt1ZlpKxQH7e4CLzdmKnsGr0Kmr4Ho1Q', 'EJDoh3Fp8n9GMS1oujFXICK3NrYzvmKh0N', 'vOAEQwOFwYSdQUK0FVtj1aKcE6b5N8Au1s', 'NDYjrCSkmSWsEp4NPUsRvzWoqafPR5ZG8I', 'bmyc4xo5965cxDCPFgLgx5JY70onYeDK09', 'EXF47bzkH5BvDNhPHWf85AlU9CYbDjoNIZ'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, IPxnaeCqqP.cs	High entropy of concatenated method names: 'kpOZ4Lt4gwgG6jEol4HErnvw3jlMytzzSEomBshznzBJFIbGZTAkLj08A5mEy3u7GX3vJ7ITpZv', 'XgYRkUjXMkKuRfYYgwrHeeyxxxx3GARfl4k2nt4TXKJFY0CueIhIZwTeZJVQab1GUIwiEddVsDm', 'dCKcADEnm1pgzEZ5NF2thGG6DPKmDQv4IuI1FfjvArWHP1gQ6ujRNDpOx6cz6DA7sO1CsCud5D5', 'N8pW5VnFzT01TiSEcaePj6duYoBWruMXXWHmpX4fEZXMLwpvNaghyN3r4sf8CByvMW8UUdFhXQX'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, T2rJptLwPG.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'J5IuNcupU83hvhiYvCxejrODgOXDKiIt7Wo8MFlP3YlHZS0AOgnpUtSpXbu6WtrvinKESr8PxuB', 'iCGZZL3rRFfoAbUpnBPykINaEAIVpbYZaPiQp2G45DCXM4m4yAEGHVf13HLiz1sfTN9cKa5Shcb', 'LnzIZCzISJljIBEHkkvvj5TVblFTJjCsy62eN2gaaDhcbXJW99vBTe6eop1mKmh97mZdQz5zd7Y', 'zc25bB6Wlur92PeZxEqWzpDfU0k2b4mb1pNeTVqJyxsykZ43HoPI4Fjkakif7N0lC0occwwDgEv'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	High entropy of concatenated method names: '_2EqnGlerJ95QK3dN35ozNwI92clP197L7qaRx4MDix', 'M3end8FIGZ4KT9P4OIrkI7lOY6uefbu1knvCiaLTQZ', 'UB86svJ6sgtJNB4AX0IWib65Z7cmqCtOCG5soF6aQE', 'WavXTkBJsA5bacGyLGwWX8bYuUY8HnU31HV7GzkR1x', 'm8FIqM5LYq2Y7u9ojLyVPnZIfEQU88ZNPNfut9nSco', 'NyR9EmAuCCsrvWQ2lS4ldaRaqXBCTYvod4gLhwfRCV', 'mvmTNdUQ0549BZn400UDatdRrwzfXd0cRQ1mmtRptI', 'eoarsbfcp1vPsD4LkP3IV1J6LH32YSojYKOBlcjB96', 'htrsTOU8XXNN899rADQLEIjZWCoQ9KkC03317eVYu3', 'c1FnzvrNrNJHwStR1vWzpcERrsPMA1JM6ryRFHarKc'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	High entropy of concatenated method names: '_4waLpMAEzWeRir3qWytT5PnoT1PSwwTtuxqYfoZyd1', '_5ZjYoZLsOvyaZnbzfGGrtQwo9hC0G6TOBapJUiPH6xMp2E8MC392OfI9CeHhdSJ8Ky2okhTvjf6BUJdUUn2pqdKeIfz4', '_0jFaZDkAojeMl3nP3zTPKOpbOk1CtRPnKqpDdZMTyiUMoao9E5PErOa20Cl0qVdxVGSheOiCLJRCjsxomRPIWeueIqBg', 's7C7nFoNrPXr2q7svwhZVbdnj6n97gS3myIPXuYNBdZZpsbhxG08ymk9tFGUk2zTIb0bFVJGMrtARtQNBnNX7lo1C5ZB', 'oiJ1zkP8qZe40ZQ5d6zU6mKGGHiMmy78gP2EFcctnwnFFHACJOQXOQsGclrcs1ruQHwj2SOYuYY93Dt9Y5d5j9DCOcMS'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, OPQSObGEdF.cs	High entropy of concatenated method names: 'nLxMkeOnhK', 'RrCIK2qlvps70cb2JD1lTEMJ09kzPxMTokjndb2YUg', 'EtzlqS3tZnwyUpZBJiMJhkmGhlpIgvnw0tWIpUToRK', 'fyKZSWca3YMdQ3kwNZe7sRlLHTPvnfDvnovTVKJVJo', 'GwaTytUCxvQPOK34A5vtH3rATveCM4blqOT4NbHhDn8lB62M6Z2OPnTz0LrlHn05MBRuZdr9XWEFhwC8LEC9KOXBWxXL', 'RId9W2xGdGQqJEAQ3oYj2A0IfHcdf3R8CKnHeGPjoLbtkDq2SeLTGjhYmF3U3zmw1kuwfFUWAKFVMgcgnz9wYoIsYD0C', 'IoJCdaApHn7iNflgF4clCmWKyCkzMKB5maKWfmCt1R6Dtr1uEuT7yQqJsy4s3t9VxBiTr0ZYzei0iSYBup8ZBJxPAOJJ', '_3TH0r03vlIN10OAfgMsthv96KEIC0woj09b5bKAQVuOHZht39AafLFzsAEV1Foz4v7vq8gQZ9Tp5HSIMarSTbVBqRlCS', 'YXAG4k8tLMvVT9gW7Dmy24WKjHpWUUTSlKj2lB9I15dvtzVvuNg0BUuk5FsqtZpBwswINpzgh5SfKed3NfVrntTxfe79', 'UuZlKO76R6ZxpWqCSkFtb7bxuSKMtyCkazEFfLs6zOXKrFjQ1xuPhmazxwJRujFetS6T1W5ev2krq7gex46QwhgKBHrw'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, AhV9cITdXv.cs	High entropy of concatenated method names: 'o66L9pVmf6', 'F2L0T4ReRRIYxR6AV87g98WDezmBJKQMtYCUBrolWftJxApx1vdZy6cDOTBM', 'eEHGXaV3WChdB3RyVXydCxEyQ3QZHz1FJxnbQcJJ0mQxHVKFaq8gDsvyynon', 'Hn4JvYR4SN1pAM9mzmo6W75hN9b4ZTwnLkopcGIfcSgeu0VDg52rKwo91WSK', 'RDIH21FTGzFpOsa7QsLwTAglGPOYNnaFxRK1xZ4c3cZckHXWYk6HR4ap37v7'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, lwCMFX9W8i.cs	High entropy of concatenated method names: 'SqZ5p8959e', '_2VoyIVV9D3', '_0RRX4Y5ycE', 'VcfrjE5JxA', '_1AmYyyaDVS', 'ugEYsiFbng', 'VBsPu5NYEX', 'iw5eT8lnQx', 'fZztcJinWH', 'yBH6HZQOkT'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, tiWHr4oL6x.cs	High entropy of concatenated method names: 'BBCX1lsSLM', 'ZWeRD6vsad', 'qrar9acQxn', 'whhd0lUifU', '_1GwOXv9cI0JjJShOAumvZeKIpwFKr3qvLhRmRNE6l1W3bvOR8FsQJTjCjjiQ9OsPk0ZjreRnQC3', 'PLOU9UQCsvkN6CG2GzHRlW4OqPPakakwEe5Sj6qhWK1vviqWNrGJYuSGqAwo', 'WRjWOmJZYIVxPkp79zEy6DDpqgo5xM5gaFx6PckgCrsKtorwYvuS2Pj99EUc', '_2bOmzBFS7qG56yPgkL6vb4D9U0YWqsNkhddZsZoQK3HsBmwNgdiurVp8reWB', 'cOI1T4oDoT6aTxDIzHQC6f3eGQ88GazQDbgmUmgStJxEuZwlqh4hU0F5fDOB', 'IINVuPw0fslgm8QAlbADV1iMx4mGNaJS9G6gLPgQMAwDnMpSLuGYcrI3Ural'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, wHUoYuStNT.cs	High entropy of concatenated method names: 'gKavcLYxB2', 'Ysj6ITnkWo', 'BWogeR5NM0', 'aNLHHkHuTj', '_94irga28Sf', 'pYvsbJzF9x', 'Q1VPVic2ED', 'EpVhXBCX0T', 'MJnGzoScGj', 'iJbM0C3tUS'
Source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, Tg2SEP0VQY.cs	High entropy of concatenated method names: '_7lJn1gsbhw', 'gwfwc4IgTH', 'niAJutz802', 'Hg5bc2RT5N', 'GcJ7OYHwP7', 'ocfBZU5brU', 'FUZFHDznAL', 'gubihUXUoM', 'nYGikdb4Tx', 'C5DdPW80RG'
Source: FluxusV1.2.2.dr, tcUBuJyp0kuY1K9nNfoDVKWb3Y2iLNMkOSt18PAfuw.cs	High entropy of concatenated method names: '_78AiBUnam0GXHIT2bUMaKPAPIxPeU3UzjHu1oVTBil', 'S5EqkR7mqWtZ6a5IDp7TyK6CW3zUveXII7p6hex5lf', '_74w4J0jQDQeaRheGhODj7J1orXj4aECV0HLwttilZo', 'jDQGzjrRie4pj7FGNp4hm5dA5PzQfrv1DC', 'gzkt1ZlpKxQH7e4CLzdmKnsGr0Kmr4Ho1Q', 'EJDoh3Fp8n9GMS1oujFXICK3NrYzvmKh0N', 'vOAEQwOFwYSdQUK0FVtj1aKcE6b5N8Au1s', 'NDYjrCSkmSWsEp4NPUsRvzWoqafPR5ZG8I', 'bmyc4xo5965cxDCPFgLgx5JY70onYeDK09', 'EXF47bzkH5BvDNhPHWf85AlU9CYbDjoNIZ'
Source: FluxusV1.2.2.dr, IPxnaeCqqP.cs	High entropy of concatenated method names: 'kpOZ4Lt4gwgG6jEol4HErnvw3jlMytzzSEomBshznzBJFIbGZTAkLj08A5mEy3u7GX3vJ7ITpZv', 'XgYRkUjXMkKuRfYYgwrHeeyxxxx3GARfl4k2nt4TXKJFY0CueIhIZwTeZJVQab1GUIwiEddVsDm', 'dCKcADEnm1pgzEZ5NF2thGG6DPKmDQv4IuI1FfjvArWHP1gQ6ujRNDpOx6cz6DA7sO1CsCud5D5', 'N8pW5VnFzT01TiSEcaePj6duYoBWruMXXWHmpX4fEZXMLwpvNaghyN3r4sf8CByvMW8UUdFhXQX'
Source: FluxusV1.2.2.dr, T2rJptLwPG.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'J5IuNcupU83hvhiYvCxejrODgOXDKiIt7Wo8MFlP3YlHZS0AOgnpUtSpXbu6WtrvinKESr8PxuB', 'iCGZZL3rRFfoAbUpnBPykINaEAIVpbYZaPiQp2G45DCXM4m4yAEGHVf13HLiz1sfTN9cKa5Shcb', 'LnzIZCzISJljIBEHkkvvj5TVblFTJjCsy62eN2gaaDhcbXJW99vBTe6eop1mKmh97mZdQz5zd7Y', 'zc25bB6Wlur92PeZxEqWzpDfU0k2b4mb1pNeTVqJyxsykZ43HoPI4Fjkakif7N0lC0occwwDgEv'
Source: FluxusV1.2.2.dr, BDbQyeWeqKawLn2TITK3XKKqFPG0FMt2ol4DmWXRG2.cs	High entropy of concatenated method names: '_2EqnGlerJ95QK3dN35ozNwI92clP197L7qaRx4MDix', 'M3end8FIGZ4KT9P4OIrkI7lOY6uefbu1knvCiaLTQZ', 'UB86svJ6sgtJNB4AX0IWib65Z7cmqCtOCG5soF6aQE', 'WavXTkBJsA5bacGyLGwWX8bYuUY8HnU31HV7GzkR1x', 'm8FIqM5LYq2Y7u9ojLyVPnZIfEQU88ZNPNfut9nSco', 'NyR9EmAuCCsrvWQ2lS4ldaRaqXBCTYvod4gLhwfRCV', 'mvmTNdUQ0549BZn400UDatdRrwzfXd0cRQ1mmtRptI', 'eoarsbfcp1vPsD4LkP3IV1J6LH32YSojYKOBlcjB96', 'htrsTOU8XXNN899rADQLEIjZWCoQ9KkC03317eVYu3', 'c1FnzvrNrNJHwStR1vWzpcERrsPMA1JM6ryRFHarKc'
Source: FluxusV1.2.2.dr, OpvejobZ5cJw6qi32Gm1gYPykqdjOxBLomxaIiMCPT.cs	High entropy of concatenated method names: '_4waLpMAEzWeRir3qWytT5PnoT1PSwwTtuxqYfoZyd1', '_5ZjYoZLsOvyaZnbzfGGrtQwo9hC0G6TOBapJUiPH6xMp2E8MC392OfI9CeHhdSJ8Ky2okhTvjf6BUJdUUn2pqdKeIfz4', '_0jFaZDkAojeMl3nP3zTPKOpbOk1CtRPnKqpDdZMTyiUMoao9E5PErOa20Cl0qVdxVGSheOiCLJRCjsxomRPIWeueIqBg', 's7C7nFoNrPXr2q7svwhZVbdnj6n97gS3myIPXuYNBdZZpsbhxG08ymk9tFGUk2zTIb0bFVJGMrtARtQNBnNX7lo1C5ZB', 'oiJ1zkP8qZe40ZQ5d6zU6mKGGHiMmy78gP2EFcctnwnFFHACJOQXOQsGclrcs1ruQHwj2SOYuYY93Dt9Y5d5j9DCOcMS'
Source: FluxusV1.2.2.dr, OPQSObGEdF.cs	High entropy of concatenated method names: 'nLxMkeOnhK', 'RrCIK2qlvps70cb2JD1lTEMJ09kzPxMTokjndb2YUg', 'EtzlqS3tZnwyUpZBJiMJhkmGhlpIgvnw0tWIpUToRK', 'fyKZSWca3YMdQ3kwNZe7sRlLHTPvnfDvnovTVKJVJo', 'GwaTytUCxvQPOK34A5vtH3rATveCM4blqOT4NbHhDn8lB62M6Z2OPnTz0LrlHn05MBRuZdr9XWEFhwC8LEC9KOXBWxXL', 'RId9W2xGdGQqJEAQ3oYj2A0IfHcdf3R8CKnHeGPjoLbtkDq2SeLTGjhYmF3U3zmw1kuwfFUWAKFVMgcgnz9wYoIsYD0C', 'IoJCdaApHn7iNflgF4clCmWKyCkzMKB5maKWfmCt1R6Dtr1uEuT7yQqJsy4s3t9VxBiTr0ZYzei0iSYBup8ZBJxPAOJJ', '_3TH0r03vlIN10OAfgMsthv96KEIC0woj09b5bKAQVuOHZht39AafLFzsAEV1Foz4v7vq8gQZ9Tp5HSIMarSTbVBqRlCS', 'YXAG4k8tLMvVT9gW7Dmy24WKjHpWUUTSlKj2lB9I15dvtzVvuNg0BUuk5FsqtZpBwswINpzgh5SfKed3NfVrntTxfe79', 'UuZlKO76R6ZxpWqCSkFtb7bxuSKMtyCkazEFfLs6zOXKrFjQ1xuPhmazxwJRujFetS6T1W5ev2krq7gex46QwhgKBHrw'
Source: FluxusV1.2.2.dr, AhV9cITdXv.cs	High entropy of concatenated method names: 'o66L9pVmf6', 'F2L0T4ReRRIYxR6AV87g98WDezmBJKQMtYCUBrolWftJxApx1vdZy6cDOTBM', 'eEHGXaV3WChdB3RyVXydCxEyQ3QZHz1FJxnbQcJJ0mQxHVKFaq8gDsvyynon', 'Hn4JvYR4SN1pAM9mzmo6W75hN9b4ZTwnLkopcGIfcSgeu0VDg52rKwo91WSK', 'RDIH21FTGzFpOsa7QsLwTAglGPOYNnaFxRK1xZ4c3cZckHXWYk6HR4ap37v7'
Source: FluxusV1.2.2.dr, lwCMFX9W8i.cs	High entropy of concatenated method names: 'SqZ5p8959e', '_2VoyIVV9D3', '_0RRX4Y5ycE', 'VcfrjE5JxA', '_1AmYyyaDVS', 'ugEYsiFbng', 'VBsPu5NYEX', 'iw5eT8lnQx', 'fZztcJinWH', 'yBH6HZQOkT'
Source: FluxusV1.2.2.dr, tiWHr4oL6x.cs	High entropy of concatenated method names: 'BBCX1lsSLM', 'ZWeRD6vsad', 'qrar9acQxn', 'whhd0lUifU', '_1GwOXv9cI0JjJShOAumvZeKIpwFKr3qvLhRmRNE6l1W3bvOR8FsQJTjCjjiQ9OsPk0ZjreRnQC3', 'PLOU9UQCsvkN6CG2GzHRlW4OqPPakakwEe5Sj6qhWK1vviqWNrGJYuSGqAwo', 'WRjWOmJZYIVxPkp79zEy6DDpqgo5xM5gaFx6PckgCrsKtorwYvuS2Pj99EUc', '_2bOmzBFS7qG56yPgkL6vb4D9U0YWqsNkhddZsZoQK3HsBmwNgdiurVp8reWB', 'cOI1T4oDoT6aTxDIzHQC6f3eGQ88GazQDbgmUmgStJxEuZwlqh4hU0F5fDOB', 'IINVuPw0fslgm8QAlbADV1iMx4mGNaJS9G6gLPgQMAwDnMpSLuGYcrI3Ural'
Source: FluxusV1.2.2.dr, wHUoYuStNT.cs	High entropy of concatenated method names: 'gKavcLYxB2', 'Ysj6ITnkWo', 'BWogeR5NM0', 'aNLHHkHuTj', '_94irga28Sf', 'pYvsbJzF9x', 'Q1VPVic2ED', 'EpVhXBCX0T', 'MJnGzoScGj', 'iJbM0C3tUS'
Source: FluxusV1.2.2.dr, Tg2SEP0VQY.cs	High entropy of concatenated method names: '_7lJn1gsbhw', 'gwfwc4IgTH', 'niAJutz802', 'Hg5bc2RT5N', 'GcJ7OYHwP7', 'ocfBZU5brU', 'FUZFHDznAL', 'gubihUXUoM', 'nYGikdb4Tx', 'C5DdPW80RG'

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\AppData\Roaming\XClient.exe	File created: C:\Users\user\AppData\Roaming\FluxusV1.2	Jump to dropped file
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	File created: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	File created: C:\Users\user\AppData\Roaming\XClient.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\XClient.exe

File created: C:\Users\user\AppData\Roaming\FluxusV1.2

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\XClient.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FluxusV1" /tr "C:\Users\user\AppData\Roaming\FluxusV1.2"

Source: C:\Users\user\AppData\Roaming\XClient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FluxusV1.lnk

Source: C:\Users\user\AppData\Roaming\XClient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FluxusV1.lnk

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\XClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FluxusV1			Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FluxusV1			Jump to behavior

Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Memory allocated: 15D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Memory allocated: 1B090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1A710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Memory allocated: 26C245A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Memory allocated: 26C3E0E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599747	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599604	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599465	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599358	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599249	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599029	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598920	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598702	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598483	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598153	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598046	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597914	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597710	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597233	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595214	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595103	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 594655	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 594510	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 586338	Jump to behavior

Source: C:\Users\user\AppData\Roaming\XClient.exe	Window / User API: threadDelayed 5669	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Window / User API: threadDelayed 4149	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Window / User API: threadDelayed 6249	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Window / User API: threadDelayed 3595	Jump to behavior

Source: C:\Users\user\Desktop\IM3OLcx7li.exe TID: 7528	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 7968	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -599859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -599747s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -599604s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -599465s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -599358s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -599249s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -599140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -599029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -598920s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -598812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -598702s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -598593s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -598483s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -598375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -598265s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -598153s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -598046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -597914s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -597710s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -597233s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -597124s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -596796s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -596249s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -596140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -595921s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -595593s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -595214s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -595103s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -594655s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -594510s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe TID: 7904	Thread sleep time: -586338s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599747	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599604	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599465	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599358	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599249	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 599029	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598920	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598702	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598483	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598153	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 598046	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597914	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597710	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597233	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595214	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 595103	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 594655	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 594510	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Thread delayed: delay time: 586338	Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Bootstrapper.exe, 00000003.00000002.1603783639.0000026C2442D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllFR=
Source: XClient.exe, 00000002.00000002.3892496244.000000001B6B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWors"%SystemRoot%\system32\mswsock.dlliceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowDefinition="MachineOnly" allowExeD
Source: Amcache.hve.14.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.14.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: IM3OLcx7li.exe, 00000000.00000002.1420326661.000000001BC48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: Amcache.hve.14.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.14.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Roaming\XClient.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\XClient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\IM3OLcx7li.exe

Memory allocated: page read and write | page guard

Yara detected Powershell download and execute

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: Process Memory Space: Bootstrapper.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: \Device\ConDrv, type: DROPPED

Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"	Jump to behavior
Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Process created: C:\Users\user\AppData\Roaming\Bootstrapper.exe "C:\Users\user\AppData\Roaming\Bootstrapper.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FluxusV1" /tr "C:\Users\user\AppData\Roaming\FluxusV1.2"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior

Source: C:\Users\user\Desktop\IM3OLcx7li.exe	Queries volume information: C:\Users\user\Desktop\IM3OLcx7li.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Queries volume information: C:\Users\user\AppData\Roaming\Bootstrapper.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation

Source: C:\Users\user\Desktop\IM3OLcx7li.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: XClient.exe, 00000002.00000002.3892496244.000000001B742000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000002.00000002.3880875516.00000000009DB000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000002.00000002.3880875516.0000000000A6B000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000002.00000002.3892496244.000000001B6B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 0.2.IM3OLcx7li.exe.30b1b50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IM3OLcx7li.exe.30c4190.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.XClient.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1417942243.0000000000452000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1419994885.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IM3OLcx7li.exe PID: 7504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\FluxusV1.2, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 0.2.IM3OLcx7li.exe.30b1b50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IM3OLcx7li.exe.30c4190.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.XClient.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IM3OLcx7li.exe.30c4190.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IM3OLcx7li.exe.30b1b50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1417942243.0000000000452000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1419994885.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IM3OLcx7li.exe PID: 7504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\FluxusV1.2, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	11 Masquerading	OS Credential Dumping	231 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
IM3OLcx7li.exe	61%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
IM3OLcx7li.exe	100%	Avira	TR/Dropper.Gen
IM3OLcx7li.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Bootstrapper.exe	100%	Avira	TR/AVI.Agent.iqkvn
C:\Users\user\AppData\Roaming\FluxusV1.2	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\XClient.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\Bootstrapper.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\FluxusV1.2	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\XClient.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Bootstrapper.exe	63%	ReversingLabs	Win64.Trojan.Malgent

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
https://www.newtonsoft.com/jsonschema	0%	URL Reputation	safe
https://www.nuget.org/packages/Newtonsoft.Json.Bson	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
edge-term4-fra4.roblox.com	128.116.44.4	true	false	unknown
getsolara.dev	172.67.203.125	true	false	unknown
www.nodejs.org	104.20.22.46	true	false	unknown
nohicsq.localto.net	185.141.35.22	true	true	unknown
clientsettings.roblox.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
nohicsq.localto.net	true	unknown
https://getsolara.dev/asset/discord.json	false	unknown
https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live	false	unknown
https://getsolara.dev/api/endpoint.json	false	unknown
https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:6463	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C261DF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:64632E	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C261DF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.nodejs.org	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2627F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.com	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C260E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://096e98d9.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2627F000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2625D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ncs.roblox.com/upload	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C26259000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2627F000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C261F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.nodejs.org	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2627F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.14.dr	false	URL Reputation: safe	unknown
https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/raw	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C261F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://james.newtonking.com/projects/json	Bootstrapper.exe.0.dr	false	URL Reputation: safe	unknown
https://096e98d9.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2627F000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C261B2000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2626F000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2625D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://edge-term4-fra4.roblox.com	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2627F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://getsolara.dev	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C26195000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.com;http://127.0.0.1:6463/rpc?v=11	Bootstrapper.exe, 00000003.00000000.1418917853.0000026C241B2000.00000002.00000001.01000000.00000007.sdmp, Bootstrapper.exe.0.dr	false		unknown
https://aka.ms/vs/17/release/vc_redist.x64.exe	Bootstrapper.exe, 00000003.00000000.1418917853.0000026C241B2000.00000002.00000001.01000000.00000007.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2627F000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe.0.dr	false		unknown
https://getsolara.dev	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C261F7000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2618A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.newtonsoft.com/jsonschema	Bootstrapper.exe.0.dr	false	URL Reputation: safe	unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson	Bootstrapper.exe, 00000003.00000000.1418917853.0000026C241B2000.00000002.00000001.01000000.00000007.sdmp, Bootstrapper.exe.0.dr	false	URL Reputation: safe	unknown
https://gist.githubusercontent.com/typeshi12/29ef3a44a19235b08aaf229631c024d8/raw	Bootstrapper.exe, 00000003.00000000.1418917853.0000026C241B2000.00000002.00000001.01000000.00000007.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C260E1000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe.0.dr	false		unknown
http://127.0.0.1:6463/rpc?v=1	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C260E1000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C261DF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	XClient.exe, 00000002.00000002.3884269378.0000000002711000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2617D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://clientsettings.roblox.com	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2627F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2627F000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C261F7000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.1604700477.0000026C26255000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pastebin.com/raw/pjseRvyK	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C261F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clientsettings.roblox.com	Bootstrapper.exe, 00000003.00000002.1604700477.0000026C2627F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/rawChttps://pastebin.c	Bootstrapper.exe, 00000003.00000000.1418917853.0000026C241B2000.00000002.00000001.01000000.00000007.sdmp, Bootstrapper.exe.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.203.125	getsolara.dev	United States	13335	CLOUDFLARENETUS	false
185.141.35.22	nohicsq.localto.net	Turkey	43260	AS43260TR	true
128.116.44.4	edge-term4-fra4.roblox.com	United States	22697	ROBLOX-PRODUCTIONUS	false
104.20.22.46	www.nodejs.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546346
Start date and time:	2024-10-31 19:45:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IM3OLcx7li.exe renamed because original name is a hash value
Original Sample Name:	2b685da51e11e912a197f6b099cc129ea596e0a17e1acda327a14da2f29cc14d.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@22/13@4/5
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 97% Number of executed functions: 151 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94, 52.182.143.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Execution Graph export aborted for target Bootstrapper.exe, PID 7616 because it is empty
Execution Graph export aborted for target IM3OLcx7li.exe, PID 7504 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: IM3OLcx7li.exe

Simulations

Behavior and APIs

Time	Type	Description
14:46:08	API Interceptor	12775623x Sleep call for process: XClient.exe modified
14:46:08	API Interceptor	49x Sleep call for process: Bootstrapper.exe modified
14:46:16	API Interceptor	2x Sleep call for process: OpenWith.exe modified
14:46:22	API Interceptor	1x Sleep call for process: WerFault.exe modified
19:46:08	Task Scheduler	Run new task: FluxusV1 path: C:\Users\user\AppData\Roaming\FluxusV1.2
19:46:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run FluxusV1 C:\Users\user\AppData\Roaming\FluxusV1.2
19:46:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run FluxusV1 C:\Users\user\AppData\Roaming\FluxusV1.2
19:46:24	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FluxusV1.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.203.125	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse
185.141.35.22	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse
	PDF.exe	Get hash	malicious	XWorm	Browse
128.116.44.4	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	https://roblox.tz/games/10449761463/BOSS-The-Strongest-Battlegrounds?privateServerLinkCode=11856892146830167735895077236647	Get hash	malicious	Unknown	Browse
	https://roblox.com.zm/games/10449761463/The-Strongest-Battlegrounds?privateServerLinkCode=22919554639422626360922039380445	Get hash	malicious	Unknown	Browse
	https://shrturl.net/pmf-gx3n	Get hash	malicious	Unknown	Browse
104.20.22.46	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.6231.15153.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse
	https://nodejs.org/dist/v20.15.0/node-v20.15.0-x64.msi	Get hash	malicious	Unknown	Browse
	3jF5V4T8LO.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	2lz.exe	Get hash	malicious	PureLog Stealer, XWorm, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.nodejs.org	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	104.20.23.46
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	104.20.23.46
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	104.20.23.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
getsolara.dev	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	172.67.203.125
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	104.21.93.27
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.203.125
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.203.125
edge-term4-fra4.roblox.com	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.4
	SecuriteInfo.com.Win32.MalwareX-gen.6231.15153.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	https://roblox.com.zm/games/10449761463/The-Strongest-Battlegrounds?privateServerLinkCode=22919554639422626360922039380445	Get hash	malicious	Unknown	Browse	128.116.44.3
	https://shrturl.net/pmf-gx3n	Get hash	malicious	Unknown	Browse	128.116.44.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROBLOX-PRODUCTIONUS	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	128.116.123.4
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	128.116.110.16
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	128.116.21.4
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	128.116.123.4
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	128.116.123.3
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	128.116.44.3
	https://www.roblox.sc/users/294681399108/profile	Get hash	malicious	Unknown	Browse	128.116.122.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.4
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	gMd6of50Do.exe	Get hash	malicious	Blank Grabber	Browse	162.159.136.232
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	aLRjksjY78.exe	Get hash	malicious	HackBrowser	Browse	162.159.136.232
	jF5cZUXeQm.exe	Get hash	malicious	Blank Grabber	Browse	162.159.135.232
	https://www.miroslavska.com/pvt/language-prefs?return_url=https:///alrbanyon.com/..&lng=en&return_url=/plain-flange_red.thick./dn-800/glatter-flansch-dn-800:813x20-pn-10-id-8195-mm	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.1.231
	original.eml	Get hash	malicious	Mamba2FA	Browse	188.114.96.3
	https://fcs-aero.com/ilsmart/marketplace/inventory/#ksunya.chan@yogiproducts.com	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
AS43260TR	SecuriteInfo.com.Win32.Trojan-gen.4672.20787.exe	Get hash	malicious	Unknown	Browse	77.73.131.1
	SecuriteInfo.com.Win32.Trojan-gen.4672.20787.exe	Get hash	malicious	Unknown	Browse	77.73.131.1
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	185.141.35.22
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	185.141.35.22
	SecuriteInfo.com.Trojan.WinGo.Agent.15048.57.exe	Get hash	malicious	Unknown	Browse	77.73.131.68
	SecuriteInfo.com.Win64.Malware-gen.27001.18486.exe	Get hash	malicious	Unknown	Browse	77.73.131.68
	SecuriteInfo.com.Trojan.WinGo.Agent.15048.57.exe	Get hash	malicious	Unknown	Browse	77.73.131.68
	SecuriteInfo.com.Win64.Malware-gen.27001.18486.exe	Get hash	malicious	Unknown	Browse	77.73.131.68
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	185.124.86.109
	0d145776475200f49119bfb3ac7ac4dd4e20fadd0fd7b.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.122.203.107
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	gMd6of50Do.exe	Get hash	malicious	Blank Grabber	Browse	162.159.136.232
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	aLRjksjY78.exe	Get hash	malicious	HackBrowser	Browse	162.159.136.232
	jF5cZUXeQm.exe	Get hash	malicious	Blank Grabber	Browse	162.159.135.232
	https://www.miroslavska.com/pvt/language-prefs?return_url=https:///alrbanyon.com/..&lng=en&return_url=/plain-flange_red.thick./dn-800/glatter-flansch-dn-800:813x20-pn-10-id-8195-mm	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.1.231
	original.eml	Get hash	malicious	Mamba2FA	Browse	188.114.96.3
	https://fcs-aero.com/ilsmart/marketplace/inventory/#ksunya.chan@yogiproducts.com	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.44.4 104.20.22.46
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.203.125 128.116.44.4 104.20.22.46
	file.exe	Get hash	malicious	LummaC	Browse	172.67.203.125 128.116.44.4 104.20.22.46
	Lana_Rhoades_Photoos.js	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.44.4 104.20.22.46
	rMT103_126021720924.exe	Get hash	malicious	AgentTesla	Browse	172.67.203.125 128.116.44.4 104.20.22.46
	https://t.ly/4Nq2x	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.67.203.125 128.116.44.4 104.20.22.46
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.44.4 104.20.22.46
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.44.4 104.20.22.46
	RFQ Proposals ADC-24-65.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.203.125 128.116.44.4 104.20.22.46
	RFQ Q700mm CB St44 PN20 e=5.6 mm TSEN 10217-1 #U7edd#U7f18#U94a2#U7ba1#Uff1a200 #U7c73.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.203.125 128.116.44.4 104.20.22.46

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Bootstrapper.exe	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Bootstrapper.exe_f8ecbb689c8f1a18ba1322c93213c0dd24b0ed4d_47e6ae6e_a7aaad88-62f4-4fc9-8dc2-7a2a9a462b64\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2627954485044162
Encrypted:	false
SSDEEP:	192:V1KDt7Dr0bU9+dQla+xejol2/fsLzuiFcZ24lO8o:V12t7cbG+dQla+l23sLzuiFcY4lO8o
MD5:	CF4E6D50B3D7D1AE44942E54909C07F9
SHA1:	4E5A1B4F649FFDD1080701FAA6CB116E0B308F29
SHA-256:	3881D6D205733041A8C7A29562892770E63E715BDF614D0F002121B91E44057B
SHA-512:	08262510F670BB91E63986EB71606DBDE274A4B9A06D1DE4E6D67532CE18E4FB8667DD79E8EB84A13EFB2A6EE24838C040979A8DE9461CF53B825E9444FC700C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.8.7.3.9.7.4.0.6.5.9.8.2.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.8.7.3.9.7.4.7.2.2.2.3.0.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.a.a.a.d.8.8.-.6.2.f.4.-.4.f.c.9.-.8.d.c.2.-.7.a.2.a.9.a.4.6.2.b.6.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.9.a.e.e.0.3.-.a.e.0.e.-.4.5.6.6.-.a.2.8.b.-.0.d.c.2.3.f.9.a.f.b.0.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.B.o.o.t.s.t.r.a.p.p.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.o.l.a.r.a.B.o.o.t.s.t.r.a.p.p.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.c.0.-.0.0.0.1.-.0.0.1.4.-.2.b.a.9.-.5.b.2.3.c.5.2.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.f.e.1.7.3.6.3.1.c.a.d.c.4.a.7.6.9.5.d.3.9.9.5.7.a.1.2.d.e.9.c.0.0.0.0.0.0.0.0.!.0.0.0.0.2.1.f.2.3.2.c.2.f.d.8.1.3.2.f.8.6.7.7.e.5.3.2.5.8.5.6.2.a.d.9.8.b.4.5.5.e.6.7.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD56.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Oct 31 18:46:14 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	605210
Entropy (8bit):	3.3023922452398446
Encrypted:	false
SSDEEP:	6144:1Y34LszP053QB8FH9+0vfc7uh14oIR/Jl8iBkqvtM:1Y34LwUQB8FH9+0vfc7P/JlSq
MD5:	B69D79D7CD59CB769AA2BE3715181720
SHA1:	C7E02E779B798E1AB2EADE59761AAA55A439A92C
SHA-256:	9614439A1CC86563CD875C07A16F0B5586B13B8A033C41757501D713E20D3014
SHA-512:	C00E7365774B04062926803F5F0676A7AE4A3E47CD8D69D9CE80339F96CA4278449A7839386E63912549A3574FBDDB6F8F2644586E97949FA4B3C8E53F565E2A
Malicious:	false
Preview:	MDMP..a..... .......v.#g............4...........<...T.......<....)...........).......T..............l.......8...........T............U..j............E...........G..............................................................................eJ......@H......Lw......................T...........k.#g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF2C.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6792
Entropy (8bit):	3.719761200657001
Encrypted:	false
SSDEEP:	192:R6l7wVeJijoZ/yix1YZX8Ppr389bT3Uf0VRm:R6lXJUoZ/yix1Y5hTEfH
MD5:	4178781A3465B908898F55EEAABEB537
SHA1:	5B8DF747D8D67E6DB22E7C08A2CC29FA17BEBB32
SHA-256:	B8FDEC32BC23D4354F1788838380BC1770982C00A38AE04CEBD1CF0C0E7699CD
SHA-512:	0230229F3D8A94D28D4AE62387D4EC476A4EFB0B35B9167684A8BD7266CE1C9C4BF6D7C090F6B9241395DC270D2D35C4452A15D8D661867B7BA37E28293CF833
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF6B.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4809
Entropy (8bit):	4.455271422455173
Encrypted:	false
SSDEEP:	48:cvIwWl8zsxJg771I9wbWpW8VYVYm8M4JnT/FN9yq8vETXU1QaBd:uIjfDI7Xq7VZJpW8U1QaBd
MD5:	38FC9CFE60A5571721BDF8E94205A751
SHA1:	39393219200D8BF8D8635D18BCF18C0F50239728
SHA-256:	4BDE7303887845BFF3238EE36C81A66CB252760374B13EA8002BB0F6B91295BC
SHA-512:	1195369C6DDC68AA29E196EFA4B803C116725BB8D5C71B2FCAEEC74F31C344A354D176471908BB490AD368A5F32F72E064433164F51A443EF9B23DE430603A06
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="567948" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IM3OLcx7li.exe.log

Process:	C:\Users\user\Desktop\IM3OLcx7li.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\AppData\Roaming\XClient.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	3.7195394315431693
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr4rNrn:EFYJKDoWrcBn
MD5:	0DB526D48DAB0E640663E4DC0EFE82BA
SHA1:	17AC435DAFEA6FF9F4D6F83FA6C54F9800F43724
SHA-256:	934290A76F9E1804069D8ED6515B14101D9D8ABA2EACBF5B260F59941C65340E
SHA-512:	FACD013E1B5B8163214CA8C3A18ADEEC3541153CD69240EEFA76DDD54809186E919C1D635AEA648A8641DE7C3216BEC11C41F04719B60F07EDFDC01FF79027B9
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]r[WIN]r

C:\Users\user\AppData\Roaming\Bootstrapper.exe

Process:	C:\Users\user\Desktop\IM3OLcx7li.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	819200
Entropy (8bit):	5.598226996524291
Encrypted:	false
SSDEEP:	12288:t0zVvgDNMoWjTmFzAzBocaKjyWtiR1pptHxQ0z:O5vgHWjTwAlocaKjyyItHDz
MD5:	2A4DCF20B82896BE94EB538260C5FB93
SHA1:	21F232C2FD8132F8677E53258562AD98B455E679
SHA-256:	EBBCB489171ABFCFCE56554DBAEACD22A15838391CBC7C756DB02995129DEF5A
SHA-512:	4F1164B2312FB94B7030D6EB6AA9F3502912FFA33505F156443570FC964BFD3BB21DED3CF84092054E07346D2DCE83A0907BA33F4BA39AD3FE7A78E836EFE288
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: cgqdM4IA7C.exe, Detection: malicious, Browse Filename: oIDX88LpSs.exe, Detection: malicious, Browse Filename: hKWBNgRd7p.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe, Detection: malicious, Browse Filename: 8svMXMXNRn.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...Ll.g.........."......v............... ....@...... ....................................`.................................................D...T.......u............................................................................................ ..H............text....t... ...v.................. ..`.rsrc...u............x..............@..@.reloc...............~..............@..BH........................................................................0..R.......(....:....r...p(....r...po....:-...r-..pr&..p.. (.....@....r...pr<..p(....(....&.......0..........rL..prT..p.(....s....%.o....%.o....%.o....%.o.....s.......o.....o....&.o....o......(....9.....o....o.............9.....o.............8.8p.......0..8.......r\..p.......%...%.r^..p.%...%.r...p.%...%.r...p.(...........(....~....%:....&~.........s....%.....(...+...0..l.........(....r...p(....(....r\..p.

C:\Users\user\AppData\Roaming\FluxusV1.2

Process:	C:\Users\user\AppData\Roaming\XClient.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75264
Entropy (8bit):	5.858531672411688
Encrypted:	false
SSDEEP:	1536:HaHqQf1yZabIdVLqYgIHW+bpPSsS+CYyvOXOTuQ8EsL3b:6KQffIqvp+bB25YyvOeTuQ8E+b
MD5:	06DF71794E08473F20B46AA17C389269
SHA1:	149AAA1816A59E05D55806EC88ADB75E7CCF079A
SHA-256:	C0D08AFC1DBCF3572160019C5074E5C58010205D158C9B2DA1B2B7E86A465321
SHA-512:	F772AAB2F848914E19BB6061A52FDAF3DA2CCD5D3BAABD6ED99C52EDC73CDAFC6FC0BBCD91E9CB17083DA51BCBA1F4F5B8A5005531141CE0C04D414AA0B018B0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\FluxusV1.2, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\FluxusV1.2, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....#g.............................:... ...@....@.. ....................................@.................................8:..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................p:......H.......D^..........&.....................................................(.....r...p. C.....(.....rW..p. .#...s.........s.........s.........s..........r...p. .....r...p. &J...r"..p. .X...r...p. '^...rT..p. ......((....r...p. .(T..r\|..p. ..."(....+.&(....&+..+5sT... .... .'..oU...(,...~....-.(D...(6...~....oV...&.-..r...p. .....rd..p. p{..r...p. .x!..rX..p. E/...r...p. ,.=...............j..................sW.............."(F...+.:.t....(

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FluxusV1.lnk

Process:	C:\Users\user\AppData\Roaming\XClient.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Oct 31 17:46:08 2024, mtime=Thu Oct 31 17:46:08 2024, atime=Thu Oct 31 17:46:08 2024, length=75264, window=hide
Category:	dropped
Size (bytes):	760
Entropy (8bit):	5.072839779701608
Encrypted:	false
SSDEEP:	12:84/sg4LpkChgY//M7L3CGK2/+kvjAsNu/Hgt/zj1mV:84/kL606Sd2nAsNuGLj1m
MD5:	40AB3D6B93F88D8BF06805CF96912DD0
SHA1:	5A6EE8460A1A1F16CFC3B7FE62207401394A348F
SHA-256:	AC63E88572BF5253CD028C55688EFC8EF1D2D6C9D8A567AD0CFEA77E1F7A52F4
SHA-512:	56CA173F17D174F9BE6D559FE6D54467CEA719FF6EC6068C8E5D8DDFE7808AD5FDE2B20808ACE477E10ECAB31C20F478CB660F45E1DB496947307C9D5DE4FF72
Malicious:	false
Preview:	L..................F.... ....&.%.+...&.%.+...&.%.+...&......................t.:..DG..Yr?.D..U..k0.&...&.......y.Yd........+..`s.%.+......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B_Y............................d...A.p.p.D.a.t.a...B.V.1....._Y...Roaming.@......EW)B_Y...............................R.o.a.m.i.n.g.....`.2..&.._Y. .FluxusV1.2..F......_Y._Y......(....................$^).F.l.u.x.u.s.V.1...2.......Y...............-.......X....................C:\Users\user\AppData\Roaming\FluxusV1.2........\.....\.....\.....\.....\.F.l.u.x.u.s.V.1...2.`.......X.......266904...........hT..CrF.f4... .G..Yc...,...E...hT..CrF.f4... .G..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\XClient.exe

Process:	C:\Users\user\Desktop\IM3OLcx7li.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75264
Entropy (8bit):	5.858531672411688
Encrypted:	false
SSDEEP:	1536:HaHqQf1yZabIdVLqYgIHW+bpPSsS+CYyvOXOTuQ8EsL3b:6KQffIqvp+bB25YyvOeTuQ8E+b
MD5:	06DF71794E08473F20B46AA17C389269
SHA1:	149AAA1816A59E05D55806EC88ADB75E7CCF079A
SHA-256:	C0D08AFC1DBCF3572160019C5074E5C58010205D158C9B2DA1B2B7E86A465321
SHA-512:	F772AAB2F848914E19BB6061A52FDAF3DA2CCD5D3BAABD6ED99C52EDC73CDAFC6FC0BBCD91E9CB17083DA51BCBA1F4F5B8A5005531141CE0C04D414AA0B018B0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....#g.............................:... ...@....@.. ....................................@.................................8:..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................p:......H.......D^..........&.....................................................(.....r...p. C.....(.....rW..p. .#...s.........s.........s.........s..........r...p. .....r...p. &J...r"..p. .X...r...p. '^...rT..p. ......((....r...p. .(T..r\|..p. ..."(....+.&(....&+..+5sT... .... .'..oU...(,...~....-.(D...(6...~....oV...&.-..r...p. .....rd..p. p{..r...p. .x!..rX..p. E/...r...p. ,.=...............j..................sW.............."(F...+.:.t....(

C:\Users\user\Desktop\DISCORD

Process:	C:\Users\user\AppData\Roaming\Bootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.081427527984575
Encrypted:	false
SSDEEP:	3:XSWHlkHFWKBgdvHvIhN9GIxFf9oQg652UTF/HLMl1m:XSWHlW0aivQLkWFfx/52uyPm
MD5:	B016DAFCA051F817C6BA098C096CB450
SHA1:	4CC74827C4B2ED534613C7764E6121CEB041B459
SHA-256:	B03C8C2D2429E9DBC7920113DEDF6FC09095AB39421EE0CC8819AD412E5D67B9
SHA-512:	D69663E1E81EC33654B87F2DFADDD5383681C8EBF029A559B201D65EB12FA2989FA66C25FA98D58066EAB7B897F0EEF6B7A68FA1A9558482A17DFED7B6076ACA
Malicious:	false
Preview:	{. "args" : {. "code" : "8PgspRYAQu". },. "cmd" : "INVITE_BROWSER",. "nonce" : ".". }

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.3723875403772565
Encrypted:	false
SSDEEP:	6144:tFVfpi6ceLP/9skLmb0cyWWSPtaJG8nAge35OlMMhA2AX4WABlguNDiL:7V1CyWWI/glMM6kF7pq
MD5:	C63ACF51318F831B467817EF445A90E0
SHA1:	91BA2A4C115FC854F1778436FA0FECA699AFB249
SHA-256:	A1D7A4A3862522CB1D93D618E94AA980603F01EE63A4A1FDFBB33067E21D1082
SHA-512:	B78FFF3283993CBE615B2615251522B7FEFB91BBFBF1FD9CE2998033F96E9D38446EAFA0EFC47E8CDC5DAA33ED1F9460F6353F4C1CD56798FD9904CC62609E57
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm._U).+................................................................................................................................................................................................................................................................................................................................................B.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Process:	C:\Users\user\AppData\Roaming\Bootstrapper.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	571
Entropy (8bit):	4.9398118662542965
Encrypted:	false
SSDEEP:	12:t+3p+t/hQAOfVaOQsXCzLQ8X+UwkY1v3igBe:Yot/h+ltcQy+UwkY1vdBe
MD5:	5294778E41EE83E1F1E78B56466AD690
SHA1:	348B8B4687216D57B8DF59BBCEC481DC9D1E61A6
SHA-256:	3AC122288181813B83236E1A2BCB449C51B50A3CA4925677A38C08B2FC6DF69C
SHA-512:	381FB6F3AA34E41C17DB3DD8E68B85508F51A94B3E77C479E40AD074767D1CEAE89B6E04FB7DD3D02A74D1AC3431B30920860A198C73387A865051538AE140F1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: \Device\ConDrv, Author: Joe Security
Preview:	.............................................................------------------------.. ..[-] Fetching endpoint.....[-] Bootstrapper up to date...[-] Killing conflicting processes.....[-] Ensuring essential directories.....[-] Ensuring essential dependencies.....[-] Downloading node......Unhandled Exception: System.Net.WebException: The operation has timed out.. at System.Net.WebClient.DownloadFile(Uri address, String fileName).. at Program.DownloadAndInstallNode().. at Program.EnsureDependencies().. at Program.Main(String[] args).

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.996102760993812
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	IM3OLcx7li.exe
File size:	907'776 bytes
MD5:	5de66177f354c6897c28610c4f7bae57
SHA1:	e8ad1bee7ca5c991d1837eb59d0c9b4033e055bf
SHA256:	2b685da51e11e912a197f6b099cc129ea596e0a17e1acda327a14da2f29cc14d
SHA512:	a4b7044c28e0ead07ade9325de64e0e1e9069d27ab4d228df4acc84952a9c9f7e05e04cdae7adb05322e413756cf906163ccf728564258ad21d558da1da471e0
SSDEEP:	24576:pIRvCHulB7EdTNb8aJFWKtJ8Bx2BIQPGfK9wNJnkSDSvmEF:pIRvCOlBOF8aJFWKtJ8Bx2BXSK6NJ
TLSH:	E01523FE481EFA3DC929B5BD2A61473F0D65DBAF714034159880D3C609EB36A7928E70
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....#g............................~.... ........@.. .......................@............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4dee7e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6723C40D [Thu Oct 31 17:53:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdee24	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe0000	0x4ce	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xdce84	0xdd000	e7c84a5820b143dd214d53e94e6071c2	False	0.939119502969457	data	7.997895898511622	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe0000	0x4ce	0x600	5b1e5dade89b256a2fb4bc7a7f7e2e23	False	0.373046875	data	3.717629241737283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe2000	0xc	0x200	e84c1fe27b59cc85a93b11005c8a0f37	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe00a0	0x244	data			0.4706896551724138
RT_MANIFEST	0xe02e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T19:46:10.383179+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49707	172.67.203.125	443	TCP
2024-10-31T19:46:22.754640+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49708	185.141.35.22	3985	TCP
2024-10-31T19:46:23.043912+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.8	49720	TCP
2024-10-31T19:47:00.849045+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.8	49725	TCP
2024-10-31T19:47:38.264525+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49729	185.141.35.22	3985	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 19:46:06.458985090 CET	49705	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:06.459048986 CET	443	49705	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:06.459126949 CET	49705	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:06.481369019 CET	49705	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:06.481400967 CET	443	49705	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:07.109344006 CET	443	49705	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:07.109545946 CET	49705	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:07.112490892 CET	49705	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:07.112513065 CET	443	49705	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:07.112768888 CET	443	49705	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:07.154452085 CET	49705	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:07.163856983 CET	49705	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:07.207333088 CET	443	49705	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:07.374038935 CET	443	49705	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:07.374115944 CET	443	49705	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:07.374325037 CET	49705	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:07.392054081 CET	49705	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:09.531649113 CET	49707	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:09.531701088 CET	443	49707	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:09.531766891 CET	49707	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:09.532856941 CET	49707	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:09.532874107 CET	443	49707	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:09.823955059 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:46:09.828741074 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:46:09.828809023 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:46:10.079237938 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:46:10.084145069 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:46:10.140659094 CET	443	49707	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:10.140746117 CET	49707	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:10.142066002 CET	49707	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:10.142074108 CET	443	49707	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:10.142299891 CET	443	49707	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:10.143363953 CET	49707	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:10.191338062 CET	443	49707	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:10.383193970 CET	443	49707	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:10.383325100 CET	443	49707	172.67.203.125	192.168.2.8
Oct 31, 2024 19:46:10.383389950 CET	49707	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:10.383927107 CET	49707	443	192.168.2.8	172.67.203.125
Oct 31, 2024 19:46:10.678239107 CET	49709	443	192.168.2.8	128.116.44.4
Oct 31, 2024 19:46:10.678303003 CET	443	49709	128.116.44.4	192.168.2.8
Oct 31, 2024 19:46:10.678388119 CET	49709	443	192.168.2.8	128.116.44.4
Oct 31, 2024 19:46:10.678634882 CET	49709	443	192.168.2.8	128.116.44.4
Oct 31, 2024 19:46:10.678653955 CET	443	49709	128.116.44.4	192.168.2.8
Oct 31, 2024 19:46:11.544258118 CET	443	49709	128.116.44.4	192.168.2.8
Oct 31, 2024 19:46:11.544338942 CET	49709	443	192.168.2.8	128.116.44.4
Oct 31, 2024 19:46:11.581981897 CET	49709	443	192.168.2.8	128.116.44.4
Oct 31, 2024 19:46:11.581995964 CET	443	49709	128.116.44.4	192.168.2.8
Oct 31, 2024 19:46:11.582341909 CET	443	49709	128.116.44.4	192.168.2.8
Oct 31, 2024 19:46:11.583846092 CET	49709	443	192.168.2.8	128.116.44.4
Oct 31, 2024 19:46:11.631339073 CET	443	49709	128.116.44.4	192.168.2.8
Oct 31, 2024 19:46:12.048357964 CET	443	49709	128.116.44.4	192.168.2.8
Oct 31, 2024 19:46:12.048459053 CET	443	49709	128.116.44.4	192.168.2.8
Oct 31, 2024 19:46:12.048512936 CET	49709	443	192.168.2.8	128.116.44.4
Oct 31, 2024 19:46:12.048937082 CET	49709	443	192.168.2.8	128.116.44.4
Oct 31, 2024 19:46:13.619256973 CET	49713	443	192.168.2.8	104.20.22.46
Oct 31, 2024 19:46:13.619292974 CET	443	49713	104.20.22.46	192.168.2.8
Oct 31, 2024 19:46:13.619627953 CET	49713	443	192.168.2.8	104.20.22.46
Oct 31, 2024 19:46:13.619627953 CET	49713	443	192.168.2.8	104.20.22.46
Oct 31, 2024 19:46:13.619662046 CET	443	49713	104.20.22.46	192.168.2.8
Oct 31, 2024 19:46:14.244545937 CET	443	49713	104.20.22.46	192.168.2.8
Oct 31, 2024 19:46:14.244676113 CET	49713	443	192.168.2.8	104.20.22.46
Oct 31, 2024 19:46:14.284147978 CET	49713	443	192.168.2.8	104.20.22.46
Oct 31, 2024 19:46:14.284173012 CET	443	49713	104.20.22.46	192.168.2.8
Oct 31, 2024 19:46:14.284465075 CET	443	49713	104.20.22.46	192.168.2.8
Oct 31, 2024 19:46:14.285305023 CET	49713	443	192.168.2.8	104.20.22.46
Oct 31, 2024 19:46:14.331336021 CET	443	49713	104.20.22.46	192.168.2.8
Oct 31, 2024 19:46:14.733270884 CET	443	49713	104.20.22.46	192.168.2.8
Oct 31, 2024 19:46:14.733386040 CET	443	49713	104.20.22.46	192.168.2.8
Oct 31, 2024 19:46:14.733438015 CET	49713	443	192.168.2.8	104.20.22.46
Oct 31, 2024 19:46:14.734025955 CET	49713	443	192.168.2.8	104.20.22.46
Oct 31, 2024 19:46:22.754640102 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:46:22.759404898 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:46:35.434360981 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:46:35.439266920 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:46:48.099664927 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:46:48.104583025 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:00.836901903 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:00.841779947 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:13.451709032 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:13.456779003 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:22.157176018 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:22.162075043 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:25.014478922 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:25.019505024 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:27.764359951 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:27.769448042 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:32.873878002 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:32.878923893 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:32.889223099 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:32.894071102 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:32.904980898 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:32.910017014 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:35.075469971 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:35.075535059 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:38.004592896 CET	49708	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:38.009124994 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:38.009928942 CET	3985	49708	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:38.014062881 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:38.014178038 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:38.115535021 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:38.121012926 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:38.264524937 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:38.269892931 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:41.267157078 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:41.272175074 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:48.530087948 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:48.535216093 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:48.576930046 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:48.582173109 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:48.592470884 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:48.597776890 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:48.608184099 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:48.613280058 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:48.654999971 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:48.660046101 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:48.686240911 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:48.691441059 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:48.733059883 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:48.738274097 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:48.748648882 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:48.753679037 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:58.780366898 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:58.785384893 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:58.921763897 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:58.927408934 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:58.999062061 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:59.004883051 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:59.045784950 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:59.050720930 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:59.061366081 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:59.066174030 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:59.077140093 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:59.081943989 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:59.202241898 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:59.207408905 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:59.217956066 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:59.222862959 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:47:59.233191967 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:47:59.239033937 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:02.111341953 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:02.116420984 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:05.313158035 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:05.318448067 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:17.280077934 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:17.285152912 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:19.749206066 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:19.754529953 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:28.155157089 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:28.160274982 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:31.782747984 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:31.787950993 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:31.889832973 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:31.894855976 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:32.875195980 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:32.880203009 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:35.983364105 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:35.988281012 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:36.030139923 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:36.034905910 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:36.077205896 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:36.082072973 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:36.092657089 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:36.097526073 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:36.123742104 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:36.128591061 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:36.186575890 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:36.191509008 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:41.373853922 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:41.378833055 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:46.249139071 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:46.254051924 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:46.327049017 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:46.334043026 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:46.342561960 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:46.347978115 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:48:49.329257011 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:48:49.334172010 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:01.297233105 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:01.302105904 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:01.592789888 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:01.597726107 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:01.655070066 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:01.659989119 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:01.717794895 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:01.722691059 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:01.795809984 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:01.800702095 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:02.030247927 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:02.035129070 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:02.045783043 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:02.050810099 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:02.061975002 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:02.066864014 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:02.092684031 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:02.099119902 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:04.702423096 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:04.707422018 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:07.358284950 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:07.496037006 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:10.952020884 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:10.956895113 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:12.545811892 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:12.550692081 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:12.592690945 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:12.597671032 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:17.858262062 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:17.863149881 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:18.686450005 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:18.691359997 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:22.999049902 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:23.004281998 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:30.655364990 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:30.660214901 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:31.858700991 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:31.863603115 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:38.233208895 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:38.238059998 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:45.623895884 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:45.628768921 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:48.998931885 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:49.004148006 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:56.171298027 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:56.176484108 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:59.061450958 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:59.066628933 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:59.108406067 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:59.113346100 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:59.139612913 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:59.144450903 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:49:59.639487028 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:49:59.644633055 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:50:01.389492989 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:50:01.395628929 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:50:04.014431953 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:50:04.019228935 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:50:05.082792044 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:50:05.082885981 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:50:09.202009916 CET	49729	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:50:09.205163002 CET	49730	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:50:09.206986904 CET	3985	49729	185.141.35.22	192.168.2.8
Oct 31, 2024 19:50:09.210360050 CET	3985	49730	185.141.35.22	192.168.2.8
Oct 31, 2024 19:50:09.210422039 CET	49730	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:50:09.284535885 CET	49730	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:50:09.289349079 CET	3985	49730	185.141.35.22	192.168.2.8
Oct 31, 2024 19:50:09.373971939 CET	49730	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:50:09.379772902 CET	3985	49730	185.141.35.22	192.168.2.8
Oct 31, 2024 19:50:12.577194929 CET	49730	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:50:12.583230019 CET	3985	49730	185.141.35.22	192.168.2.8
Oct 31, 2024 19:50:23.920762062 CET	49730	3985	192.168.2.8	185.141.35.22
Oct 31, 2024 19:50:23.925825119 CET	3985	49730	185.141.35.22	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 19:46:06.439824104 CET	50732	53	192.168.2.8	1.1.1.1
Oct 31, 2024 19:46:06.447458982 CET	53	50732	1.1.1.1	192.168.2.8
Oct 31, 2024 19:46:09.720592976 CET	65460	53	192.168.2.8	1.1.1.1
Oct 31, 2024 19:46:09.765808105 CET	53	65460	1.1.1.1	192.168.2.8
Oct 31, 2024 19:46:10.666807890 CET	51473	53	192.168.2.8	1.1.1.1
Oct 31, 2024 19:46:10.674335003 CET	53	51473	1.1.1.1	192.168.2.8
Oct 31, 2024 19:46:13.610344887 CET	56090	53	192.168.2.8	1.1.1.1
Oct 31, 2024 19:46:13.617872953 CET	53	56090	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 19:46:06.439824104 CET	192.168.2.8	1.1.1.1	0x1f4a	Standard query (0)	getsolara.dev	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:09.720592976 CET	192.168.2.8	1.1.1.1	0xc916	Standard query (0)	nohicsq.localto.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:10.666807890 CET	192.168.2.8	1.1.1.1	0xc7a6	Standard query (0)	clientsettings.roblox.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:13.610344887 CET	192.168.2.8	1.1.1.1	0x6862	Standard query (0)	www.nodejs.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 19:46:06.447458982 CET	1.1.1.1	192.168.2.8	0x1f4a	No error (0)	getsolara.dev		172.67.203.125	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:06.447458982 CET	1.1.1.1	192.168.2.8	0x1f4a	No error (0)	getsolara.dev		104.21.93.27	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:09.765808105 CET	1.1.1.1	192.168.2.8	0xc916	No error (0)	nohicsq.localto.net		185.141.35.22	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:10.674335003 CET	1.1.1.1	192.168.2.8	0xc7a6	No error (0)	clientsettings.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:10.674335003 CET	1.1.1.1	192.168.2.8	0xc7a6	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:10.674335003 CET	1.1.1.1	192.168.2.8	0xc7a6	No error (0)	edge-term4.roblox.com	edge-term4-fra4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:10.674335003 CET	1.1.1.1	192.168.2.8	0xc7a6	No error (0)	edge-term4-fra4.roblox.com		128.116.44.4	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:13.617872953 CET	1.1.1.1	192.168.2.8	0x6862	No error (0)	www.nodejs.org		104.20.22.46	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:13.617872953 CET	1.1.1.1	192.168.2.8	0x6862	No error (0)	www.nodejs.org		104.20.23.46	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

getsolara.dev

clientsettings.roblox.com

www.nodejs.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	172.67.203.125	443	7616	C:\Users\user\AppData\Roaming\Bootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 18:46:07 UTC	81	OUT	GET /asset/discord.json HTTP/1.1 Host: getsolara.dev Connection: Keep-Alive
2024-10-31 18:46:07 UTC	1017	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 18:46:07 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"7d966f73b6ce74a610dddaf0d0951ed8" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jvArD5Hs70oP2hkJksLUclu0dV333uzhQvzce0Lg10p4e6VgVPgIY6jl9dul3WrlIjUgXUlLA3mYYv6LBNN3TJQXdQCLJtwYR5PineGVPdJz%2BsN6zskiMs%2FAmVDaJe7H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8db5ce5729d34752-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1874&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2813&recv_bytes=695&delivery_rate=1584245&cwnd=251&unsent_bytes=0&cid=8a73d6c4d7806e37&ts=277&x=0"
2024-10-31 18:46:07 UTC	109	IN	Data Raw: 36 37 0d 0a 7b 0a 20 20 20 20 22 61 72 67 73 22 20 3a 20 7b 0a 20 20 20 20 20 20 20 22 63 6f 64 65 22 20 3a 20 22 38 50 67 73 70 52 59 41 51 75 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 63 6d 64 22 20 3a 20 22 49 4e 56 49 54 45 5f 42 52 4f 57 53 45 52 22 2c 0a 20 20 20 20 22 6e 6f 6e 63 65 22 20 3a 20 22 2e 22 0a 20 7d 0d 0a Data Ascii: 67{ "args" : { "code" : "8PgspRYAQu" }, "cmd" : "INVITE_BROWSER", "nonce" : "." }
2024-10-31 18:46:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	172.67.203.125	443	7616	C:\Users\user\AppData\Roaming\Bootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 18:46:10 UTC	56	OUT	GET /api/endpoint.json HTTP/1.1 Host: getsolara.dev
2024-10-31 18:46:10 UTC	1016	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 18:46:10 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"a72e086f622b38afe59e084f73bd2f20" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fL0Xd9gUzdJWAIeyZ0rN8h5M4f8l30HyXJs4YwijBc06LNRhsTgKaZWPCOwBbjAKoqTQ%2B6OBHfjfAU3VEdRLGm4jkKCPmbURRqCgpsoiSNGC3QchMNA9N%2BEtNZW4dfm9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8db5ce69cea0e98f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1209&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2812&recv_bytes=694&delivery_rate=2466780&cwnd=40&unsent_bytes=0&cid=9aded624f517f9b3&ts=248&x=0"
2024-10-31 18:46:10 UTC	353	IN	Data Raw: 32 31 63 0d 0a 7b 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 20 22 31 2e 32 32 22 2c 0a 20 20 20 20 22 53 75 70 70 6f 72 74 65 64 43 6c 69 65 6e 74 22 3a 20 22 76 65 72 73 69 6f 6e 2d 62 37 65 65 62 63 39 31 39 65 39 36 34 37 37 61 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 56 65 72 73 69 6f 6e 22 3a 20 22 33 2e 31 32 35 22 2c 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 30 39 36 65 39 38 64 39 2e 73 6f 6c 61 72 61 77 65 62 2d 61 6c 6a 2e 70 61 67 65 73 2e 64 65 76 2f 64 6f 77 6e 6c 6f 61 64 2f 73 74 61 74 69 63 2f 66 69 6c 65 73 2f 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 65 78 65 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 55 72 6c 22 3a 22 68 74 74 70 73 Data Ascii: 21c{ "BootstrapperVersion": "1.22", "SupportedClient": "version-b7eebc919e96477a", "SoftwareVersion": "3.125", "BootstrapperUrl": "https://096e98d9.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe", "SoftwareUrl":"https
2024-10-31 18:46:10 UTC	194	IN	Data Raw: 3a 2f 2f 63 6c 69 65 6e 74 73 65 74 74 69 6e 67 73 2e 72 6f 62 6c 6f 78 2e 63 6f 6d 2f 76 32 2f 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 2f 57 69 6e 64 6f 77 73 50 6c 61 79 65 72 2f 63 68 61 6e 6e 65 6c 2f 6c 69 76 65 22 2c 0a 20 20 20 20 22 43 6c 69 65 6e 74 48 61 73 68 22 3a 22 64 64 38 65 63 62 61 36 30 32 39 36 61 64 34 62 39 36 32 66 63 32 61 34 66 33 36 65 38 33 34 32 61 33 32 39 65 62 34 66 30 66 34 31 64 31 33 30 31 65 65 37 38 39 31 63 31 31 34 34 34 33 35 38 22 2c 0a 20 20 20 20 22 43 68 61 6e 67 65 6c 6f 67 22 3a 22 5b 2b 5d 20 55 70 64 61 74 65 64 22 0a 7d 0d 0a Data Ascii: ://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live", "ClientHash":"dd8ecba60296ad4b962fc2a4f36e8342a329eb4f0f41d1301ee7891c11444358", "Changelog":"[+] Updated"}
2024-10-31 18:46:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	128.116.44.4	443	7616	C:\Users\user\AppData\Roaming\Bootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 18:46:11 UTC	119	OUT	GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1 Host: clientsettings.roblox.com Connection: Keep-Alive
2024-10-31 18:46:12 UTC	576	IN	HTTP/1.1 200 OK content-length: 119 content-type: application/json; charset=utf-8 date: Thu, 31 Oct 2024 18:46:11 GMT server: Kestrel cache-control: no-cache strict-transport-security: max-age=3600 x-frame-options: SAMEORIGIN roblox-machine-id: d845e8bd-e2db-db17-c71a-088763b68f55 x-roblox-region: us-central_rbx x-roblox-edge: fra4 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://ncs.roblox.com/upload"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1} connection: close
2024-10-31 18:46:12 UTC	119	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 22 30 2e 36 34 39 2e 30 2e 36 34 39 30 38 37 38 22 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 55 70 6c 6f 61 64 22 3a 22 76 65 72 73 69 6f 6e 2d 62 37 65 65 62 63 39 31 39 65 39 36 34 37 37 61 22 2c 22 62 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 22 31 2c 20 36 2c 20 30 2c 20 36 34 39 30 38 37 38 22 7d Data Ascii: {"version":"0.649.0.6490878","clientVersionUpload":"version-b7eebc919e96477a","bootstrapperVersion":"1, 6, 0, 6490878"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49713	104.20.22.46	443	7616	C:\Users\user\AppData\Roaming\Bootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 18:46:14 UTC	99	OUT	GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1 Host: www.nodejs.org Connection: Keep-Alive
2024-10-31 18:46:14 UTC	497	IN	HTTP/1.1 307 Temporary Redirect Date: Thu, 31 Oct 2024 18:46:14 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=0, must-revalidate location: https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi strict-transport-security: max-age=31536000; includeSubDomains; preload x-vercel-id: cle1::rrvsl-1730400374647-0252c4e0fe89 CF-Cache-Status: DYNAMIC X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8db5ce83bf49e72e-DFW
2024-10-31 18:46:14 UTC	20	IN	Data Raw: 66 0d 0a 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 0a 0d 0a Data Ascii: fRedirecting...
2024-10-31 18:46:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:46:03
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\IM3OLcx7li.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\IM3OLcx7li.exe"
Imagebase:	0xbb0000
File size:	907'776 bytes
MD5 hash:	5DE66177F354C6897C28610C4F7BAE57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1419994885.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1419994885.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	14:46:03
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\XClient.exe"
Imagebase:	0x450000
File size:	75'264 bytes
MD5 hash:	06DF71794E08473F20B46AA17C389269
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000000.1417942243.0000000000452000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000000.1417942243.0000000000452000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	14:46:03
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Roaming\Bootstrapper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Bootstrapper.exe"
Imagebase:	0x26c241b0000
File size:	819'200 bytes
MD5 hash:	2A4DCF20B82896BE94EB538260C5FB93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	moderate
Has exited:	true

Target ID:	4
Start time:	14:46:03
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	14:46:04
Start date:	31/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c ipconfig /all
Imagebase:	0x7ff77f880000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	14:46:04
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	14:46:04
Start date:	31/10/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff764be0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	8
Start time:	14:46:08
Start date:	31/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FluxusV1" /tr "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff73f770000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	14:46:08
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	14:46:08
Start date:	31/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff6faca0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	14:46:13
Start date:	31/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7616 -s 2192
Imagebase:	0x7ff629370000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	14:46:16
Start date:	31/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6faca0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	14:46:24
Start date:	31/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6faca0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	14:47:01
Start date:	31/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff6faca0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	26
Start time:	14:48:00
Start date:	31/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff6faca0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	27
Start time:	14:49:00
Start date:	31/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff6faca0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	14:50:00
Start date:	31/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe "C:\Users\user\AppData\Roaming\FluxusV1.2"
Imagebase:	0x7ff6faca0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true