Windows Analysis Report
kwlYObMOSn.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 4.0.XClient.exe.f20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000000.2051658508.0000000000F22000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2053142429.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Teams.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Code function: 2_2_00007FF848F52540	2_2_00007FF848F52540
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Code function: 2_2_00007FF848F46DB0	2_2_00007FF848F46DB0
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Code function: 2_2_00007FF848F44928	2_2_00007FF848F44928
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 4_2_00007FF848F21689	4_2_00007FF848F21689
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 4_2_00007FF848F284D2	4_2_00007FF848F284D2
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 4_2_00007FF848F27726	4_2_00007FF848F27726
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 4_2_00007FF848F20EFA	4_2_00007FF848F20EFA
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 4_2_00007FF848F21FC1	4_2_00007FF848F21FC1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 10_2_00007FF848F31689	10_2_00007FF848F31689
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 10_2_00007FF848F30EFA	10_2_00007FF848F30EFA
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 10_2_00007FF848F31FC1	10_2_00007FF848F31FC1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 11_2_00007FF848F01689	11_2_00007FF848F01689
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 11_2_00007FF848F01FC1	11_2_00007FF848F01FC1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 11_2_00007FF848F00EFA	11_2_00007FF848F00EFA
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 17_2_00007FF848F11689	17_2_00007FF848F11689
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 17_2_00007FF848F10EFA	17_2_00007FF848F10EFA
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 17_2_00007FF848F11FC1	17_2_00007FF848F11FC1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 19_2_00007FF848F31689	19_2_00007FF848F31689
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 19_2_00007FF848F30EFA	19_2_00007FF848F30EFA
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 19_2_00007FF848F31FC1	19_2_00007FF848F31FC1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 20_2_00007FF848F21689	20_2_00007FF848F21689
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 20_2_00007FF848F20EFA	20_2_00007FF848F20EFA
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 20_2_00007FF848F21FC1	20_2_00007FF848F21FC1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 21_2_00007FF848F21689	21_2_00007FF848F21689
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 21_2_00007FF848F20EFA	21_2_00007FF848F20EFA
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 21_2_00007FF848F21FC1	21_2_00007FF848F21FC1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 22_2_00007FF848F31689	22_2_00007FF848F31689
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 22_2_00007FF848F30EFA	22_2_00007FF848F30EFA
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 22_2_00007FF848F31FC1	22_2_00007FF848F31FC1

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe 8F2E28588F2303BD8D7A9B0C3FF6A9CB16FA93F8DDC9C5E0666A8C12D6880EE3

Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2860 -s 2196

Source: kwlYObMOSn.exe, 00000000.00000000.2042845470.0000000000DDE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXevo.exe4 vs kwlYObMOSn.exe
Source: kwlYObMOSn.exe, 00000000.00000002.2053142429.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs kwlYObMOSn.exe
Source: kwlYObMOSn.exe	Binary or memory string: OriginalFilenameXevo.exe4 vs kwlYObMOSn.exe

Source: kwlYObMOSn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.0.XClient.exe.f20000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000000.2051658508.0000000000F22000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2053142429.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\Teams.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: kwlYObMOSn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kwlYObMOSn.exe, Program.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, galkvGG8EiPIcJR8LGppC8UxAdk7MX8S4JE18u0WRgtlYT5nELAVXthyxxBMjLf5FGgVcaoSmNKYAFZkLood1AVt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, galkvGG8EiPIcJR8LGppC8UxAdk7MX8S4JE18u0WRgtlYT5nELAVXthyxxBMjLf5FGgVcaoSmNKYAFZkLood1AVt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, galkvGG8EiPIcJR8LGppC8UxAdk7MX8S4JE18u0WRgtlYT5nELAVXthyxxBMjLf5FGgVcaoSmNKYAFZkLood1AVt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Teams.exe.4.dr, galkvGG8EiPIcJR8LGppC8UxAdk7MX8S4JE18u0WRgtlYT5nELAVXthyxxBMjLf5FGgVcaoSmNKYAFZkLood1AVt.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, F5vMHDl0yhQPqFo1H7ie55ng.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, F5vMHDl0yhQPqFo1H7ie55ng.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Teams.exe.4.dr, F5vMHDl0yhQPqFo1H7ie55ng.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Teams.exe.4.dr, F5vMHDl0yhQPqFo1H7ie55ng.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: XClient.exe.0.dr, F5vMHDl0yhQPqFo1H7ie55ng.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XClient.exe.0.dr, F5vMHDl0yhQPqFo1H7ie55ng.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, F5vMHDl0yhQPqFo1H7ie55ng.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, F5vMHDl0yhQPqFo1H7ie55ng.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@22/13@5/5

Source: C:\Users\user\Desktop\kwlYObMOSn.exe

File created: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe

Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Mutant created: \Sessions\1\BaseNamedObjects\bKGK9XtDE4HepKISm
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4296:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Teams.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\XClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\4QViFEjJzqTHCbHq
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2860

Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe

File created: C:\Users\user\AppData\Local\Temp\node-v18.16.0-x64.msi

Source: kwlYObMOSn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kwlYObMOSn.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\kwlYObMOSn.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\kwlYObMOSn.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: kwlYObMOSn.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\kwlYObMOSn.exe "C:\Users\user\Desktop\kwlYObMOSn.exe"
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process created: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe "C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe"
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Teams" /tr "C:\Users\user\AppData\Roaming\Teams.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Teams.exe C:\Users\user\AppData\Roaming\Teams.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Teams.exe "C:\Users\user\AppData\Roaming\Teams.exe"
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2860 -s 2196
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Teams.exe "C:\Users\user\AppData\Roaming\Teams.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Teams.exe C:\Users\user\AppData\Roaming\Teams.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Teams.exe C:\Users\user\AppData\Roaming\Teams.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Teams.exe C:\Users\user\AppData\Roaming\Teams.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Teams.exe C:\Users\user\AppData\Roaming\Teams.exe
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process created: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe "C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Teams" /tr "C:\Users\user\AppData\Roaming\Teams.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior

Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Teams.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\kwlYObMOSn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: Teams.lnk.4.dr

LNK file: ..\..\..\..\..\Teams.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\kwlYObMOSn.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: kwlYObMOSn.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kwlYObMOSn.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Numerics.pdb0D source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Data.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.ni.pdbRSDS source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E6802D0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdbpH source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.pdb 0 source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Data.ni.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: BootstrapperV1.23.exe, 00000002.00000002.2547110487.000001E6EBE1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E6802D0000.00000004.00000800.00020000.00000000.sdmp, WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Numerics.ni.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Data.pdbH source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdbH source: WER9337.tmp.dmp.14.dr
Source:	Binary string: mscorlib.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: mscorlib.ni.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Core.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER9337.tmp.dmp.14.dr
Source:	Binary string: m.pdb source: BootstrapperV1.23.exe, 00000002.00000002.2547594514.000001E6EE236000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Numerics.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.ni.pdb source: WER9337.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER9337.tmp.dmp.14.dr

Data Obfuscation

Source: XClient.exe.0.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Uc3BjQmcdurs1N4Pk8uOPT3r._8INdwf8o8QeXO9oljCg2qau3,Uc3BjQmcdurs1N4Pk8uOPT3r.w4jjQAiWJjeWjPn5LGOnd2rh,Uc3BjQmcdurs1N4Pk8uOPT3r.Oc2SgI0FMUad2iOhT13qTv7x,Uc3BjQmcdurs1N4Pk8uOPT3r.HCjNWVI0UaCoWdctk2D0X5kD,TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.l7s6lE7HnjB689NpEb9j6bRw8y5esn6Io4lJz1O2cbx45UBPSbFjkQ7MxDu2Ed8aGatPCv0W95()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.0.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{qWABHFmQnV3vztJxi66C2CggGqVQqnFb8zrIJ7ZIg28vHsgoBuuO56eGx9ZyDdO6C2tZHTugemlHHEcDtmsdVSIK[2],TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.pq8Es3hqExtddH31UC6maYpyOgIBJ1ns4zvxO0gDXB78bfXDEulWaIWEVTSIRbqbwLFo96jsZ2(Convert.FromBase64String(qWABHFmQnV3vztJxi66C2CggGqVQqnFb8zrIJ7ZIg28vHsgoBuuO56eGx9ZyDdO6C2tZHTugemlHHEcDtmsdVSIK[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Uc3BjQmcdurs1N4Pk8uOPT3r._8INdwf8o8QeXO9oljCg2qau3,Uc3BjQmcdurs1N4Pk8uOPT3r.w4jjQAiWJjeWjPn5LGOnd2rh,Uc3BjQmcdurs1N4Pk8uOPT3r.Oc2SgI0FMUad2iOhT13qTv7x,Uc3BjQmcdurs1N4Pk8uOPT3r.HCjNWVI0UaCoWdctk2D0X5kD,TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.l7s6lE7HnjB689NpEb9j6bRw8y5esn6Io4lJz1O2cbx45UBPSbFjkQ7MxDu2Ed8aGatPCv0W95()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{qWABHFmQnV3vztJxi66C2CggGqVQqnFb8zrIJ7ZIg28vHsgoBuuO56eGx9ZyDdO6C2tZHTugemlHHEcDtmsdVSIK[2],TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.pq8Es3hqExtddH31UC6maYpyOgIBJ1ns4zvxO0gDXB78bfXDEulWaIWEVTSIRbqbwLFo96jsZ2(Convert.FromBase64String(qWABHFmQnV3vztJxi66C2CggGqVQqnFb8zrIJ7ZIg28vHsgoBuuO56eGx9ZyDdO6C2tZHTugemlHHEcDtmsdVSIK[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Uc3BjQmcdurs1N4Pk8uOPT3r._8INdwf8o8QeXO9oljCg2qau3,Uc3BjQmcdurs1N4Pk8uOPT3r.w4jjQAiWJjeWjPn5LGOnd2rh,Uc3BjQmcdurs1N4Pk8uOPT3r.Oc2SgI0FMUad2iOhT13qTv7x,Uc3BjQmcdurs1N4Pk8uOPT3r.HCjNWVI0UaCoWdctk2D0X5kD,TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.l7s6lE7HnjB689NpEb9j6bRw8y5esn6Io4lJz1O2cbx45UBPSbFjkQ7MxDu2Ed8aGatPCv0W95()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{qWABHFmQnV3vztJxi66C2CggGqVQqnFb8zrIJ7ZIg28vHsgoBuuO56eGx9ZyDdO6C2tZHTugemlHHEcDtmsdVSIK[2],TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.pq8Es3hqExtddH31UC6maYpyOgIBJ1ns4zvxO0gDXB78bfXDEulWaIWEVTSIRbqbwLFo96jsZ2(Convert.FromBase64String(qWABHFmQnV3vztJxi66C2CggGqVQqnFb8zrIJ7ZIg28vHsgoBuuO56eGx9ZyDdO6C2tZHTugemlHHEcDtmsdVSIK[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Teams.exe.4.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Uc3BjQmcdurs1N4Pk8uOPT3r._8INdwf8o8QeXO9oljCg2qau3,Uc3BjQmcdurs1N4Pk8uOPT3r.w4jjQAiWJjeWjPn5LGOnd2rh,Uc3BjQmcdurs1N4Pk8uOPT3r.Oc2SgI0FMUad2iOhT13qTv7x,Uc3BjQmcdurs1N4Pk8uOPT3r.HCjNWVI0UaCoWdctk2D0X5kD,TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.l7s6lE7HnjB689NpEb9j6bRw8y5esn6Io4lJz1O2cbx45UBPSbFjkQ7MxDu2Ed8aGatPCv0W95()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Teams.exe.4.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{qWABHFmQnV3vztJxi66C2CggGqVQqnFb8zrIJ7ZIg28vHsgoBuuO56eGx9ZyDdO6C2tZHTugemlHHEcDtmsdVSIK[2],TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.pq8Es3hqExtddH31UC6maYpyOgIBJ1ns4zvxO0gDXB78bfXDEulWaIWEVTSIRbqbwLFo96jsZ2(Convert.FromBase64String(qWABHFmQnV3vztJxi66C2CggGqVQqnFb8zrIJ7ZIg28vHsgoBuuO56eGx9ZyDdO6C2tZHTugemlHHEcDtmsdVSIK[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: XClient.exe.0.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: QH6BzTzzL1KqBZpIuFs51GiP0ooeey6t2gKmhw3JQMHBFhQBGCZ3vouD System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: WQeCpH8EhMH9FT1oWn2I4MAqvRX9YldCWTBGPD3fu7dY1lRZOpOQBCdLGPpwYplVHjR25GLuESdhpEeBqFlguDIl System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: WQeCpH8EhMH9FT1oWn2I4MAqvRX9YldCWTBGPD3fu7dY1lRZOpOQBCdLGPpwYplVHjR25GLuESdhpEeBqFlguDIl
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: QH6BzTzzL1KqBZpIuFs51GiP0ooeey6t2gKmhw3JQMHBFhQBGCZ3vouD System.AppDomain.Load(byte[])
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: WQeCpH8EhMH9FT1oWn2I4MAqvRX9YldCWTBGPD3fu7dY1lRZOpOQBCdLGPpwYplVHjR25GLuESdhpEeBqFlguDIl System.AppDomain.Load(byte[])
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: WQeCpH8EhMH9FT1oWn2I4MAqvRX9YldCWTBGPD3fu7dY1lRZOpOQBCdLGPpwYplVHjR25GLuESdhpEeBqFlguDIl
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: QH6BzTzzL1KqBZpIuFs51GiP0ooeey6t2gKmhw3JQMHBFhQBGCZ3vouD System.AppDomain.Load(byte[])
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: WQeCpH8EhMH9FT1oWn2I4MAqvRX9YldCWTBGPD3fu7dY1lRZOpOQBCdLGPpwYplVHjR25GLuESdhpEeBqFlguDIl System.AppDomain.Load(byte[])
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: WQeCpH8EhMH9FT1oWn2I4MAqvRX9YldCWTBGPD3fu7dY1lRZOpOQBCdLGPpwYplVHjR25GLuESdhpEeBqFlguDIl
Source: Teams.exe.4.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: QH6BzTzzL1KqBZpIuFs51GiP0ooeey6t2gKmhw3JQMHBFhQBGCZ3vouD System.AppDomain.Load(byte[])
Source: Teams.exe.4.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: WQeCpH8EhMH9FT1oWn2I4MAqvRX9YldCWTBGPD3fu7dY1lRZOpOQBCdLGPpwYplVHjR25GLuESdhpEeBqFlguDIl System.AppDomain.Load(byte[])
Source: Teams.exe.4.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	.Net Code: WQeCpH8EhMH9FT1oWn2I4MAqvRX9YldCWTBGPD3fu7dY1lRZOpOQBCdLGPpwYplVHjR25GLuESdhpEeBqFlguDIl

Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Code function: 0_2_00007FF848F200BD pushad ; iretd	0_2_00007FF848F200C1
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Code function: 2_2_00007FF848F5D668 push ss; retf	2_2_00007FF848F5D837
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Code function: 2_2_00007FF848F5A272 push ebx; retf	2_2_00007FF848F5A282
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Code function: 2_2_00007FF848F400BD pushad ; iretd	2_2_00007FF848F400C1
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 4_2_00007FF848F21288 push ebx; retf FFEFh	4_2_00007FF848F2134A
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 4_2_00007FF848F200BD pushad ; iretd	4_2_00007FF848F200C1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 10_2_00007FF848F300BD pushad ; iretd	10_2_00007FF848F300C1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 17_2_00007FF848F100BD pushad ; iretd	17_2_00007FF848F100C1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 19_2_00007FF848F300BD pushad ; iretd	19_2_00007FF848F300C1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 20_2_00007FF848F200BD pushad ; iretd	20_2_00007FF848F200C1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 21_2_00007FF848F200BD pushad ; iretd	21_2_00007FF848F200C1
Source: C:\Users\user\AppData\Roaming\Teams.exe	Code function: 22_2_00007FF848F300BD pushad ; iretd	22_2_00007FF848F300C1

Source: kwlYObMOSn.exe

Static PE information: section name: .text entropy: 7.998505878740895

Source: XClient.exe.0.dr, 8geLz7PVJDaHJbPqbQcZhNJgzEYf94XxUjqToyM7ntcdaErGYo85BKZd5IU2rTC2VTHwDLwlQR.cs	High entropy of concatenated method names: 'uQRqgRCZAI2DLD4VZztwHIa2xB7rcn4KBVvQgd8wntRPFcfChBEcM1MVLyk1oWiCJZ70ydYESo', 'P9ClOHa4rdlhCfAL', '_8O7FpOeok5QJPY2M', '_1Lh7vxdiNyOh4xplo71TKYxNTFIluIVOdhgkI2kfZvRRbHrCbHo', '_17nP4NzneHKSpy6pdgPpVs7ZVeLImiBE03PwZzVyFOeJmLyQo4A', '_2mtUAoy1PpsiO3a6WVS8vt4JDEVD6fxsxWYi6aEpmrWCYQHgtW9', 'pF0gZckkZIhzsVx8qS6ryFY5k8F3PISS4xCzcIHphArwL78x5uS', 'ptccob2gnTJGPvhwotnNYcEmx8rlLfXz1cVD12PL9rDzLzTSpBU', 'zBVEIMs6Brz10OdxLT3NXvSU2g4J7CEA9FDwgYrdgnawBQG4rTV', '_1mI298zT5Ncrgaymc6Yxjf5pBTYy9wM3OxHSc8YHTfSfmeeLOtn'
Source: XClient.exe.0.dr, Uc3BjQmcdurs1N4Pk8uOPT3r.cs	High entropy of concatenated method names: 'LIQW8jYDJQYI4x5LlOPgbwhMaU9LQZ7njJyJjpby9nf9nSTzsOsoRMg0OtuQLuK8lEirs3ldOSC2uWYxgeZAnavitIg', 'uobLoYbpfOS2gFExFHNEl8xGtAAhONvvRiCcHvgCFKMGtxQcaxXRNayXrW2QtQtnsySAsXAimlV0JGehwzWqx5B5dDz', '_3ecpUmWdVZGLbB0HkWul2MUlQYx1flc6FmIUw7Pb1oMKyYssKy155wOBju2Nc5M7K7NCjL0A5MENiKSVIBGbXbuV0ZL', 'V6fkO4govhkzWuUWVVoIjmI1ysVqLZkDT9uxhlwqGWFs6ZuFZbvmNQinxkFpJWQcQ6g2z2oyZ48q0UMKTQ5KV004UDZ'
Source: XClient.exe.0.dr, jo5XtzA2m7JH1S9wBz7M2Z2mAmU9QBxH2A204V.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'Nj1K87Wq3d1jNDDqPZjSrXrWJIEAIOR3yPogCdBsWvxZtNR27HRfQNQF2FTTffK3tgITmjEiJWbdvszUkVAfEKTMRW4', 'yEMLQpTfjLhInCdYYjQeD01R2ZzocmV6v6t9mmWd1x1ebbTvOPluqqukwGkykoNP5zKe8SEEuKog7MTqYu63O3Zl6vO', 'Ok9lHapzpi5sNXQa1mmnoTA01HV46aEsCody8fBndwLXXtIqA7HhIiBp52zYZzprXM7k9wdIzlcgKqIpa7PyUlr4lnO', 'GcTJqnh5FCcyKu1r3YdH0TUpnTNdFE3sZnXENtKsLoZQ3KzyjKe8vOnXVooloZxJJvmzWUoM1vUkaIx3XbtKa4KkXJs'
Source: XClient.exe.0.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	High entropy of concatenated method names: 'Znz1YJbjDstF3NnCtce9JA5rvdCTEIiVIaYeZby890EK9ogT5gc2hzIF', 'QH6BzTzzL1KqBZpIuFs51GiP0ooeey6t2gKmhw3JQMHBFhQBGCZ3vouD', 'peMVjIfxwRiF2zyIqbgXQr6yKGk0owQXCDxTpQL9Z8hwkbnP7xj35HQi', 'kI7NpaySKqRsWiRSd3wfgM0ynfPtM0NheDNeyKxRYDIorB8zvn26XV5N', 'Bo6RAokTurylQeyxBlbnaZgIIMOSLrb34Q6zYsN2ptxKbE46iggr8VBw', 'OTNoPcpn2FUWyPDUtNdNRTmCkjpseegnxdLsmvo3P43zxFLHsUM53v49', 'mUFbQRip6QDF2MCeKJyOgcnLUqjGmtuiLz3IAZae3wkqsiYxgbFQAYqQ', 'cT1goHaztVDbTi5lLou7fesoYqqqEhqodRKbs2lXLZsZIFFIiXd7EY0J', 'L4TKjPPvq2gqLdM9k3xyfBKjnDE7n3TiUxJqsWgPBROsQe3stiAea1yB01EnnliWftDCpfu0VdflOiL13RZIU15L', '_9B0s2RQ36gmV2Q7g8v77F7Ln3jUnJJVSivs9mjErF27Nr3ttqayNn48AoF66CaizfjJzbGf6OORwXlCPkJ3PuUOS'
Source: XClient.exe.0.dr, uC4bX9qmnfDttpZXgexIMCB3.cs	High entropy of concatenated method names: 'nNtoatmovcCMfktBBqWvVSlu', 'qbFH3Tk9ffXeadnS69DVF7F5', 'dPovAIFp4d38VfpIQHRkmd1T', 'TiIJNIcbO0Rlt6or7mWc8LfIqGb5xfaBEAagpmE6qAaJqi7ffsTVpQH34YsEH1Y4xSGTy39zzlPGVQ6af8cihl5uUCh', 'LUFgBfZwnUGTK5yaCcpctVmaqlanJq3IYhXgie53Xlw11AzOQM7p64nZFQpy5UFxqNEHfngHC1lMFHBFS52Oy1tOnIi', 'ubtNdMj2CpELyOwKdi58UGLE4yqjfou62', '_9Vg6xoiOBscSTkOZTFie5VKcMSobDzt0Z', 'elcLxLdMPUAQ3Z4XJ7ywr2Yw8aYdV7JV9', 'vKJ0EB23zmyxiqi7HlrqIKpUHkujCDkmA', 'Rg8qNclJhsV9fzncMtsxK5qLYWrUYh7xZ'
Source: XClient.exe.0.dr, vPNx814kaDySqqPhZPNlS3exd80mmXA9ptWc7VoO4zvsTK1evI9iBv81QuL59JyYJiuTuLTbA3G76EYcMcVv9q40.cs	High entropy of concatenated method names: 'l5MJF0vpQPJbUi71eFmUKTDhTY4Qwe877PvKoC4AB6JDQknrfFUaw5kyeV94CdnFoqksQtX0GQ8QEYntElP6ZGb3', 'xadeNV33MWKl5ms8jqjZD0kspA3zgxSwbqWBtzJxU6XbnTGvM34bwTXaWXiyVs9zx8lgDH0khvtWJnMAmEyyEAW7', 'v9Fj1jch3K7q7vFQqK7wFPKgbAnehIAhCz8Bh2DxhbL683MRLRzJHam7PDCl3bx6vbipxIQiHeNng9VQVOlkhnIP', '_6EuL6rtRB2wxtDPigGvSJbVeyp7pubSTB77yoqQConnyxAoW0wQTN8KAYeSEjhgJPpJjp0KF6mqGVobSQ7D2tGWp', 'LDpI5pYf8eFqUamVqoHXHCf2xu5xRJ0TnSxKgGT8NJnAYoAd3rMerMdnXjrMBQLwLO', 'SW1VEzjRrMzvE2DQ4CHJRnoiBROVSOA7d91fahrwhV6Wu7yLgyGjTln6cOrKyoDnpY', 'BFXzEZCS9KAUMQtzWacglUUPkQ8LEgIgF9x0rqf853IdpbStbEsMC17IKVqIUOxdmL', 'SbMmqA7RXo3F7ufyItURyE8Sd2IOxhQkxP3TYPHS3wGO4PxwAQ63iw8MT62C8F5NMH', 'ljxl7SDLTB17wg7T5Ic8GdBUbXVhBjihDIKIhpl3RmPHEnSk1R53dDpyVK5LPAfqIh', '_7rm44ml0UApjPS3xuApn44aaFRMyvyrroQ4Pplt5cSVI1xVsfobeyw9NgNGQHnclMB'
Source: XClient.exe.0.dr, AxNLL2qwxotWTTDijmh3abU9Hb1wEfkrtuIE6gqinoCcVgRHPXqDrnQS8dNmaPvOvMUEfjVeA48bXQTvWiwwN4WG.cs	High entropy of concatenated method names: 'HVSotpCw10PcbHgH9MuOwxBcgfITzdLTTkFSvkAnRDpyHer2YKJxFb5ShJdlTEfmscttiby0r648GMSbrsEqtsh8', 'nLQlpxLvvbz4mtmEKujPJRdNfjBt1YkPOHgjdI4EuCuMksAfG0ioZznbhFSj1hCg7v', 'M1Bqx7EqAQj3oJy1AKG54GtNfEKET3XOGHpEQ3NOQInnGBvLho3N57KtyR4tzXUeYj', 'JgdyLHTGtqhT4a8wZFflZhwR849GQTDNS7txbK23bJFSdynkSnASKK3jUkE0sdUePE', 'hOfK58Hbm0QmouKpxdtOmEf3AxUNgHQoi5SOdBSLPV1lHQXH8R0PSWEGls0HbM1jec'
Source: XClient.exe.0.dr, galkvGG8EiPIcJR8LGppC8UxAdk7MX8S4JE18u0WRgtlYT5nELAVXthyxxBMjLf5FGgVcaoSmNKYAFZkLood1AVt.cs	High entropy of concatenated method names: 'Uf2T3bngWgeL4s5tZ70Gst0sZnfSOh5PiGIYyOwkvUwYr4h59ysCFYiWsV6Wt1cxb8p3lRHWNi4Wb01Re3Zozthj', 'XirxY2rgKavEADTJ9Z7Rl9PebpLHA3QarbS38VBW3WoPJrzUTHPHPJqa6oGqbFV3l1', '_3NCMA70TImJrlux0OjR4S5Yv71eKKLSccNkydVtkHQ88P2gVV3zE7BgVZa5071FGft', 'lX0Qi7Vnt7Gn31KeOBq1ucH2GHjMhsBzYONHsrYgq3xhrWlAxC5i2eKOskyFrCUEhF', 'ptyEPlCXtr4k3Cnim1ABAKZ5LG1H3vhWAd7ztgAxcZTHxSz6a32MwDPfvbx6in1oA9'
Source: XClient.exe.0.dr, F5vMHDl0yhQPqFo1H7ie55ng.cs	High entropy of concatenated method names: 'xCYvtnsP0UJSi3tqykECf0HF', 'RguiYWheTClE8b3yzBgXHLe0', 'wPzOcYqjLN91bmwgFWMVfVlLwYhmcpZCuL6MZNnSUIcSyLMgYRqNfav1', 'V719StdNeaONVJbg3iX25X5670sWyWWwZWYgJYEIYPKSXfI6pQuxu9jF', 'CqEIOTKT22I1I4uHbbUs3VbONxFkTxWJ9LESUKAdDClu5DnonD04hJn9', 'ZTjyHggJsUJxAQCQSqdwtA0MHsCN8AaI2KHSxNNOUpDRxemOY78QE0e7', 'qzLSp9r3Y6YX1hsrUSXKMvJbxoZhGesmStoZuooY6Zy3y1HpFRnZlPHQ', 'dRTifIhuMX4untF0SZeyukSpdy63Ck5SBOooOMHDS0nxOjMfR88Us43H', 'eUfL4dvqO0ihFJZptqAc6ynEVnxnXBCHP3rbYMrmlHnnCGETbIOhcBsr', 'n6H3gA1VCzzgDAIAuuDAmpq5oAFfglG6HYIxlW8EeriiHhmoV2Qpqpep'
Source: XClient.exe.0.dr, TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.cs	High entropy of concatenated method names: '_6R9honep9Q8eNg9wARu2CxfZzQA7tmHpyjLnG1lRtiZ9HeOupft2BvngKPmAxjKoiKLuuCSWtbFAHRXCf8cvSY8D', 'j9GqnvN2L46twQJS9tIoq87b8um7b4U1xmslatuYbEGrSUtxzwTxyDP4ilDYqpb3HvZylBhQsr', 'ZSkqGJMDnmujgo7UORaxccfIfin76euDMm9gzmNgoZzZMiok059speRmekYABH2eE4b7nO072m', 'ltJMOWlfwBblpJ2y4KlR8TlGGQfrAMs0XRtdQ2YyMwueDGbqEcB8HdLuMmG92XpBH12gnxh1JP', '_0hHubFKJV1w2GXnk243jP14ZJMLBCp7jk5xGxszM3C8JshBZdCFVuE2xk5jTDtR8fomP3ziCMi', 'xqRv7SyYJPujqdreAdBCUySC6QHiZlp6GfyEyQrhlW2hKdhsGmkJMMOrJOZYwHC5ofUnlp7moL', 'JHCYE7XA9LlDbd5safZBX6SR6ro4c3HG9jAZqukr2detWdKLjk3VPd8atGgIir9D85XSUFIgvx', 'NDmyOdePDqhRJGznyiBg6X6fnk4TsGP1J3DO2FOoCQZ5Omd3Yw4WgpvKbDdTFGiLBqimYDLV15', 'tIeaWxATc7ukxLfQA3JwBLtNThXJ0Q6NIZhP7UNPgabzCmPzn8bfWdwNlOftps6z9guhk9qM4u', 'wcgtDaSeJHxSrzkZMCmVpSisUMqsT5EntvCZq6oBxd4o6XoNKzHaYclAPCog5yU2yCDTcAL7Eg'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, 8geLz7PVJDaHJbPqbQcZhNJgzEYf94XxUjqToyM7ntcdaErGYo85BKZd5IU2rTC2VTHwDLwlQR.cs	High entropy of concatenated method names: 'uQRqgRCZAI2DLD4VZztwHIa2xB7rcn4KBVvQgd8wntRPFcfChBEcM1MVLyk1oWiCJZ70ydYESo', 'P9ClOHa4rdlhCfAL', '_8O7FpOeok5QJPY2M', '_1Lh7vxdiNyOh4xplo71TKYxNTFIluIVOdhgkI2kfZvRRbHrCbHo', '_17nP4NzneHKSpy6pdgPpVs7ZVeLImiBE03PwZzVyFOeJmLyQo4A', '_2mtUAoy1PpsiO3a6WVS8vt4JDEVD6fxsxWYi6aEpmrWCYQHgtW9', 'pF0gZckkZIhzsVx8qS6ryFY5k8F3PISS4xCzcIHphArwL78x5uS', 'ptccob2gnTJGPvhwotnNYcEmx8rlLfXz1cVD12PL9rDzLzTSpBU', 'zBVEIMs6Brz10OdxLT3NXvSU2g4J7CEA9FDwgYrdgnawBQG4rTV', '_1mI298zT5Ncrgaymc6Yxjf5pBTYy9wM3OxHSc8YHTfSfmeeLOtn'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, Uc3BjQmcdurs1N4Pk8uOPT3r.cs	High entropy of concatenated method names: 'LIQW8jYDJQYI4x5LlOPgbwhMaU9LQZ7njJyJjpby9nf9nSTzsOsoRMg0OtuQLuK8lEirs3ldOSC2uWYxgeZAnavitIg', 'uobLoYbpfOS2gFExFHNEl8xGtAAhONvvRiCcHvgCFKMGtxQcaxXRNayXrW2QtQtnsySAsXAimlV0JGehwzWqx5B5dDz', '_3ecpUmWdVZGLbB0HkWul2MUlQYx1flc6FmIUw7Pb1oMKyYssKy155wOBju2Nc5M7K7NCjL0A5MENiKSVIBGbXbuV0ZL', 'V6fkO4govhkzWuUWVVoIjmI1ysVqLZkDT9uxhlwqGWFs6ZuFZbvmNQinxkFpJWQcQ6g2z2oyZ48q0UMKTQ5KV004UDZ'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, jo5XtzA2m7JH1S9wBz7M2Z2mAmU9QBxH2A204V.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'Nj1K87Wq3d1jNDDqPZjSrXrWJIEAIOR3yPogCdBsWvxZtNR27HRfQNQF2FTTffK3tgITmjEiJWbdvszUkVAfEKTMRW4', 'yEMLQpTfjLhInCdYYjQeD01R2ZzocmV6v6t9mmWd1x1ebbTvOPluqqukwGkykoNP5zKe8SEEuKog7MTqYu63O3Zl6vO', 'Ok9lHapzpi5sNXQa1mmnoTA01HV46aEsCody8fBndwLXXtIqA7HhIiBp52zYZzprXM7k9wdIzlcgKqIpa7PyUlr4lnO', 'GcTJqnh5FCcyKu1r3YdH0TUpnTNdFE3sZnXENtKsLoZQ3KzyjKe8vOnXVooloZxJJvmzWUoM1vUkaIx3XbtKa4KkXJs'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	High entropy of concatenated method names: 'Znz1YJbjDstF3NnCtce9JA5rvdCTEIiVIaYeZby890EK9ogT5gc2hzIF', 'QH6BzTzzL1KqBZpIuFs51GiP0ooeey6t2gKmhw3JQMHBFhQBGCZ3vouD', 'peMVjIfxwRiF2zyIqbgXQr6yKGk0owQXCDxTpQL9Z8hwkbnP7xj35HQi', 'kI7NpaySKqRsWiRSd3wfgM0ynfPtM0NheDNeyKxRYDIorB8zvn26XV5N', 'Bo6RAokTurylQeyxBlbnaZgIIMOSLrb34Q6zYsN2ptxKbE46iggr8VBw', 'OTNoPcpn2FUWyPDUtNdNRTmCkjpseegnxdLsmvo3P43zxFLHsUM53v49', 'mUFbQRip6QDF2MCeKJyOgcnLUqjGmtuiLz3IAZae3wkqsiYxgbFQAYqQ', 'cT1goHaztVDbTi5lLou7fesoYqqqEhqodRKbs2lXLZsZIFFIiXd7EY0J', 'L4TKjPPvq2gqLdM9k3xyfBKjnDE7n3TiUxJqsWgPBROsQe3stiAea1yB01EnnliWftDCpfu0VdflOiL13RZIU15L', '_9B0s2RQ36gmV2Q7g8v77F7Ln3jUnJJVSivs9mjErF27Nr3ttqayNn48AoF66CaizfjJzbGf6OORwXlCPkJ3PuUOS'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, uC4bX9qmnfDttpZXgexIMCB3.cs	High entropy of concatenated method names: 'nNtoatmovcCMfktBBqWvVSlu', 'qbFH3Tk9ffXeadnS69DVF7F5', 'dPovAIFp4d38VfpIQHRkmd1T', 'TiIJNIcbO0Rlt6or7mWc8LfIqGb5xfaBEAagpmE6qAaJqi7ffsTVpQH34YsEH1Y4xSGTy39zzlPGVQ6af8cihl5uUCh', 'LUFgBfZwnUGTK5yaCcpctVmaqlanJq3IYhXgie53Xlw11AzOQM7p64nZFQpy5UFxqNEHfngHC1lMFHBFS52Oy1tOnIi', 'ubtNdMj2CpELyOwKdi58UGLE4yqjfou62', '_9Vg6xoiOBscSTkOZTFie5VKcMSobDzt0Z', 'elcLxLdMPUAQ3Z4XJ7ywr2Yw8aYdV7JV9', 'vKJ0EB23zmyxiqi7HlrqIKpUHkujCDkmA', 'Rg8qNclJhsV9fzncMtsxK5qLYWrUYh7xZ'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, vPNx814kaDySqqPhZPNlS3exd80mmXA9ptWc7VoO4zvsTK1evI9iBv81QuL59JyYJiuTuLTbA3G76EYcMcVv9q40.cs	High entropy of concatenated method names: 'l5MJF0vpQPJbUi71eFmUKTDhTY4Qwe877PvKoC4AB6JDQknrfFUaw5kyeV94CdnFoqksQtX0GQ8QEYntElP6ZGb3', 'xadeNV33MWKl5ms8jqjZD0kspA3zgxSwbqWBtzJxU6XbnTGvM34bwTXaWXiyVs9zx8lgDH0khvtWJnMAmEyyEAW7', 'v9Fj1jch3K7q7vFQqK7wFPKgbAnehIAhCz8Bh2DxhbL683MRLRzJHam7PDCl3bx6vbipxIQiHeNng9VQVOlkhnIP', '_6EuL6rtRB2wxtDPigGvSJbVeyp7pubSTB77yoqQConnyxAoW0wQTN8KAYeSEjhgJPpJjp0KF6mqGVobSQ7D2tGWp', 'LDpI5pYf8eFqUamVqoHXHCf2xu5xRJ0TnSxKgGT8NJnAYoAd3rMerMdnXjrMBQLwLO', 'SW1VEzjRrMzvE2DQ4CHJRnoiBROVSOA7d91fahrwhV6Wu7yLgyGjTln6cOrKyoDnpY', 'BFXzEZCS9KAUMQtzWacglUUPkQ8LEgIgF9x0rqf853IdpbStbEsMC17IKVqIUOxdmL', 'SbMmqA7RXo3F7ufyItURyE8Sd2IOxhQkxP3TYPHS3wGO4PxwAQ63iw8MT62C8F5NMH', 'ljxl7SDLTB17wg7T5Ic8GdBUbXVhBjihDIKIhpl3RmPHEnSk1R53dDpyVK5LPAfqIh', '_7rm44ml0UApjPS3xuApn44aaFRMyvyrroQ4Pplt5cSVI1xVsfobeyw9NgNGQHnclMB'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, AxNLL2qwxotWTTDijmh3abU9Hb1wEfkrtuIE6gqinoCcVgRHPXqDrnQS8dNmaPvOvMUEfjVeA48bXQTvWiwwN4WG.cs	High entropy of concatenated method names: 'HVSotpCw10PcbHgH9MuOwxBcgfITzdLTTkFSvkAnRDpyHer2YKJxFb5ShJdlTEfmscttiby0r648GMSbrsEqtsh8', 'nLQlpxLvvbz4mtmEKujPJRdNfjBt1YkPOHgjdI4EuCuMksAfG0ioZznbhFSj1hCg7v', 'M1Bqx7EqAQj3oJy1AKG54GtNfEKET3XOGHpEQ3NOQInnGBvLho3N57KtyR4tzXUeYj', 'JgdyLHTGtqhT4a8wZFflZhwR849GQTDNS7txbK23bJFSdynkSnASKK3jUkE0sdUePE', 'hOfK58Hbm0QmouKpxdtOmEf3AxUNgHQoi5SOdBSLPV1lHQXH8R0PSWEGls0HbM1jec'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, galkvGG8EiPIcJR8LGppC8UxAdk7MX8S4JE18u0WRgtlYT5nELAVXthyxxBMjLf5FGgVcaoSmNKYAFZkLood1AVt.cs	High entropy of concatenated method names: 'Uf2T3bngWgeL4s5tZ70Gst0sZnfSOh5PiGIYyOwkvUwYr4h59ysCFYiWsV6Wt1cxb8p3lRHWNi4Wb01Re3Zozthj', 'XirxY2rgKavEADTJ9Z7Rl9PebpLHA3QarbS38VBW3WoPJrzUTHPHPJqa6oGqbFV3l1', '_3NCMA70TImJrlux0OjR4S5Yv71eKKLSccNkydVtkHQ88P2gVV3zE7BgVZa5071FGft', 'lX0Qi7Vnt7Gn31KeOBq1ucH2GHjMhsBzYONHsrYgq3xhrWlAxC5i2eKOskyFrCUEhF', 'ptyEPlCXtr4k3Cnim1ABAKZ5LG1H3vhWAd7ztgAxcZTHxSz6a32MwDPfvbx6in1oA9'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, F5vMHDl0yhQPqFo1H7ie55ng.cs	High entropy of concatenated method names: 'xCYvtnsP0UJSi3tqykECf0HF', 'RguiYWheTClE8b3yzBgXHLe0', 'wPzOcYqjLN91bmwgFWMVfVlLwYhmcpZCuL6MZNnSUIcSyLMgYRqNfav1', 'V719StdNeaONVJbg3iX25X5670sWyWWwZWYgJYEIYPKSXfI6pQuxu9jF', 'CqEIOTKT22I1I4uHbbUs3VbONxFkTxWJ9LESUKAdDClu5DnonD04hJn9', 'ZTjyHggJsUJxAQCQSqdwtA0MHsCN8AaI2KHSxNNOUpDRxemOY78QE0e7', 'qzLSp9r3Y6YX1hsrUSXKMvJbxoZhGesmStoZuooY6Zy3y1HpFRnZlPHQ', 'dRTifIhuMX4untF0SZeyukSpdy63Ck5SBOooOMHDS0nxOjMfR88Us43H', 'eUfL4dvqO0ihFJZptqAc6ynEVnxnXBCHP3rbYMrmlHnnCGETbIOhcBsr', 'n6H3gA1VCzzgDAIAuuDAmpq5oAFfglG6HYIxlW8EeriiHhmoV2Qpqpep'
Source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.cs	High entropy of concatenated method names: '_6R9honep9Q8eNg9wARu2CxfZzQA7tmHpyjLnG1lRtiZ9HeOupft2BvngKPmAxjKoiKLuuCSWtbFAHRXCf8cvSY8D', 'j9GqnvN2L46twQJS9tIoq87b8um7b4U1xmslatuYbEGrSUtxzwTxyDP4ilDYqpb3HvZylBhQsr', 'ZSkqGJMDnmujgo7UORaxccfIfin76euDMm9gzmNgoZzZMiok059speRmekYABH2eE4b7nO072m', 'ltJMOWlfwBblpJ2y4KlR8TlGGQfrAMs0XRtdQ2YyMwueDGbqEcB8HdLuMmG92XpBH12gnxh1JP', '_0hHubFKJV1w2GXnk243jP14ZJMLBCp7jk5xGxszM3C8JshBZdCFVuE2xk5jTDtR8fomP3ziCMi', 'xqRv7SyYJPujqdreAdBCUySC6QHiZlp6GfyEyQrhlW2hKdhsGmkJMMOrJOZYwHC5ofUnlp7moL', 'JHCYE7XA9LlDbd5safZBX6SR6ro4c3HG9jAZqukr2detWdKLjk3VPd8atGgIir9D85XSUFIgvx', 'NDmyOdePDqhRJGznyiBg6X6fnk4TsGP1J3DO2FOoCQZ5Omd3Yw4WgpvKbDdTFGiLBqimYDLV15', 'tIeaWxATc7ukxLfQA3JwBLtNThXJ0Q6NIZhP7UNPgabzCmPzn8bfWdwNlOftps6z9guhk9qM4u', 'wcgtDaSeJHxSrzkZMCmVpSisUMqsT5EntvCZq6oBxd4o6XoNKzHaYclAPCog5yU2yCDTcAL7Eg'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, 8geLz7PVJDaHJbPqbQcZhNJgzEYf94XxUjqToyM7ntcdaErGYo85BKZd5IU2rTC2VTHwDLwlQR.cs	High entropy of concatenated method names: 'uQRqgRCZAI2DLD4VZztwHIa2xB7rcn4KBVvQgd8wntRPFcfChBEcM1MVLyk1oWiCJZ70ydYESo', 'P9ClOHa4rdlhCfAL', '_8O7FpOeok5QJPY2M', '_1Lh7vxdiNyOh4xplo71TKYxNTFIluIVOdhgkI2kfZvRRbHrCbHo', '_17nP4NzneHKSpy6pdgPpVs7ZVeLImiBE03PwZzVyFOeJmLyQo4A', '_2mtUAoy1PpsiO3a6WVS8vt4JDEVD6fxsxWYi6aEpmrWCYQHgtW9', 'pF0gZckkZIhzsVx8qS6ryFY5k8F3PISS4xCzcIHphArwL78x5uS', 'ptccob2gnTJGPvhwotnNYcEmx8rlLfXz1cVD12PL9rDzLzTSpBU', 'zBVEIMs6Brz10OdxLT3NXvSU2g4J7CEA9FDwgYrdgnawBQG4rTV', '_1mI298zT5Ncrgaymc6Yxjf5pBTYy9wM3OxHSc8YHTfSfmeeLOtn'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, Uc3BjQmcdurs1N4Pk8uOPT3r.cs	High entropy of concatenated method names: 'LIQW8jYDJQYI4x5LlOPgbwhMaU9LQZ7njJyJjpby9nf9nSTzsOsoRMg0OtuQLuK8lEirs3ldOSC2uWYxgeZAnavitIg', 'uobLoYbpfOS2gFExFHNEl8xGtAAhONvvRiCcHvgCFKMGtxQcaxXRNayXrW2QtQtnsySAsXAimlV0JGehwzWqx5B5dDz', '_3ecpUmWdVZGLbB0HkWul2MUlQYx1flc6FmIUw7Pb1oMKyYssKy155wOBju2Nc5M7K7NCjL0A5MENiKSVIBGbXbuV0ZL', 'V6fkO4govhkzWuUWVVoIjmI1ysVqLZkDT9uxhlwqGWFs6ZuFZbvmNQinxkFpJWQcQ6g2z2oyZ48q0UMKTQ5KV004UDZ'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, jo5XtzA2m7JH1S9wBz7M2Z2mAmU9QBxH2A204V.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'Nj1K87Wq3d1jNDDqPZjSrXrWJIEAIOR3yPogCdBsWvxZtNR27HRfQNQF2FTTffK3tgITmjEiJWbdvszUkVAfEKTMRW4', 'yEMLQpTfjLhInCdYYjQeD01R2ZzocmV6v6t9mmWd1x1ebbTvOPluqqukwGkykoNP5zKe8SEEuKog7MTqYu63O3Zl6vO', 'Ok9lHapzpi5sNXQa1mmnoTA01HV46aEsCody8fBndwLXXtIqA7HhIiBp52zYZzprXM7k9wdIzlcgKqIpa7PyUlr4lnO', 'GcTJqnh5FCcyKu1r3YdH0TUpnTNdFE3sZnXENtKsLoZQ3KzyjKe8vOnXVooloZxJJvmzWUoM1vUkaIx3XbtKa4KkXJs'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	High entropy of concatenated method names: 'Znz1YJbjDstF3NnCtce9JA5rvdCTEIiVIaYeZby890EK9ogT5gc2hzIF', 'QH6BzTzzL1KqBZpIuFs51GiP0ooeey6t2gKmhw3JQMHBFhQBGCZ3vouD', 'peMVjIfxwRiF2zyIqbgXQr6yKGk0owQXCDxTpQL9Z8hwkbnP7xj35HQi', 'kI7NpaySKqRsWiRSd3wfgM0ynfPtM0NheDNeyKxRYDIorB8zvn26XV5N', 'Bo6RAokTurylQeyxBlbnaZgIIMOSLrb34Q6zYsN2ptxKbE46iggr8VBw', 'OTNoPcpn2FUWyPDUtNdNRTmCkjpseegnxdLsmvo3P43zxFLHsUM53v49', 'mUFbQRip6QDF2MCeKJyOgcnLUqjGmtuiLz3IAZae3wkqsiYxgbFQAYqQ', 'cT1goHaztVDbTi5lLou7fesoYqqqEhqodRKbs2lXLZsZIFFIiXd7EY0J', 'L4TKjPPvq2gqLdM9k3xyfBKjnDE7n3TiUxJqsWgPBROsQe3stiAea1yB01EnnliWftDCpfu0VdflOiL13RZIU15L', '_9B0s2RQ36gmV2Q7g8v77F7Ln3jUnJJVSivs9mjErF27Nr3ttqayNn48AoF66CaizfjJzbGf6OORwXlCPkJ3PuUOS'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, uC4bX9qmnfDttpZXgexIMCB3.cs	High entropy of concatenated method names: 'nNtoatmovcCMfktBBqWvVSlu', 'qbFH3Tk9ffXeadnS69DVF7F5', 'dPovAIFp4d38VfpIQHRkmd1T', 'TiIJNIcbO0Rlt6or7mWc8LfIqGb5xfaBEAagpmE6qAaJqi7ffsTVpQH34YsEH1Y4xSGTy39zzlPGVQ6af8cihl5uUCh', 'LUFgBfZwnUGTK5yaCcpctVmaqlanJq3IYhXgie53Xlw11AzOQM7p64nZFQpy5UFxqNEHfngHC1lMFHBFS52Oy1tOnIi', 'ubtNdMj2CpELyOwKdi58UGLE4yqjfou62', '_9Vg6xoiOBscSTkOZTFie5VKcMSobDzt0Z', 'elcLxLdMPUAQ3Z4XJ7ywr2Yw8aYdV7JV9', 'vKJ0EB23zmyxiqi7HlrqIKpUHkujCDkmA', 'Rg8qNclJhsV9fzncMtsxK5qLYWrUYh7xZ'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, vPNx814kaDySqqPhZPNlS3exd80mmXA9ptWc7VoO4zvsTK1evI9iBv81QuL59JyYJiuTuLTbA3G76EYcMcVv9q40.cs	High entropy of concatenated method names: 'l5MJF0vpQPJbUi71eFmUKTDhTY4Qwe877PvKoC4AB6JDQknrfFUaw5kyeV94CdnFoqksQtX0GQ8QEYntElP6ZGb3', 'xadeNV33MWKl5ms8jqjZD0kspA3zgxSwbqWBtzJxU6XbnTGvM34bwTXaWXiyVs9zx8lgDH0khvtWJnMAmEyyEAW7', 'v9Fj1jch3K7q7vFQqK7wFPKgbAnehIAhCz8Bh2DxhbL683MRLRzJHam7PDCl3bx6vbipxIQiHeNng9VQVOlkhnIP', '_6EuL6rtRB2wxtDPigGvSJbVeyp7pubSTB77yoqQConnyxAoW0wQTN8KAYeSEjhgJPpJjp0KF6mqGVobSQ7D2tGWp', 'LDpI5pYf8eFqUamVqoHXHCf2xu5xRJ0TnSxKgGT8NJnAYoAd3rMerMdnXjrMBQLwLO', 'SW1VEzjRrMzvE2DQ4CHJRnoiBROVSOA7d91fahrwhV6Wu7yLgyGjTln6cOrKyoDnpY', 'BFXzEZCS9KAUMQtzWacglUUPkQ8LEgIgF9x0rqf853IdpbStbEsMC17IKVqIUOxdmL', 'SbMmqA7RXo3F7ufyItURyE8Sd2IOxhQkxP3TYPHS3wGO4PxwAQ63iw8MT62C8F5NMH', 'ljxl7SDLTB17wg7T5Ic8GdBUbXVhBjihDIKIhpl3RmPHEnSk1R53dDpyVK5LPAfqIh', '_7rm44ml0UApjPS3xuApn44aaFRMyvyrroQ4Pplt5cSVI1xVsfobeyw9NgNGQHnclMB'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, AxNLL2qwxotWTTDijmh3abU9Hb1wEfkrtuIE6gqinoCcVgRHPXqDrnQS8dNmaPvOvMUEfjVeA48bXQTvWiwwN4WG.cs	High entropy of concatenated method names: 'HVSotpCw10PcbHgH9MuOwxBcgfITzdLTTkFSvkAnRDpyHer2YKJxFb5ShJdlTEfmscttiby0r648GMSbrsEqtsh8', 'nLQlpxLvvbz4mtmEKujPJRdNfjBt1YkPOHgjdI4EuCuMksAfG0ioZznbhFSj1hCg7v', 'M1Bqx7EqAQj3oJy1AKG54GtNfEKET3XOGHpEQ3NOQInnGBvLho3N57KtyR4tzXUeYj', 'JgdyLHTGtqhT4a8wZFflZhwR849GQTDNS7txbK23bJFSdynkSnASKK3jUkE0sdUePE', 'hOfK58Hbm0QmouKpxdtOmEf3AxUNgHQoi5SOdBSLPV1lHQXH8R0PSWEGls0HbM1jec'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, galkvGG8EiPIcJR8LGppC8UxAdk7MX8S4JE18u0WRgtlYT5nELAVXthyxxBMjLf5FGgVcaoSmNKYAFZkLood1AVt.cs	High entropy of concatenated method names: 'Uf2T3bngWgeL4s5tZ70Gst0sZnfSOh5PiGIYyOwkvUwYr4h59ysCFYiWsV6Wt1cxb8p3lRHWNi4Wb01Re3Zozthj', 'XirxY2rgKavEADTJ9Z7Rl9PebpLHA3QarbS38VBW3WoPJrzUTHPHPJqa6oGqbFV3l1', '_3NCMA70TImJrlux0OjR4S5Yv71eKKLSccNkydVtkHQ88P2gVV3zE7BgVZa5071FGft', 'lX0Qi7Vnt7Gn31KeOBq1ucH2GHjMhsBzYONHsrYgq3xhrWlAxC5i2eKOskyFrCUEhF', 'ptyEPlCXtr4k3Cnim1ABAKZ5LG1H3vhWAd7ztgAxcZTHxSz6a32MwDPfvbx6in1oA9'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, F5vMHDl0yhQPqFo1H7ie55ng.cs	High entropy of concatenated method names: 'xCYvtnsP0UJSi3tqykECf0HF', 'RguiYWheTClE8b3yzBgXHLe0', 'wPzOcYqjLN91bmwgFWMVfVlLwYhmcpZCuL6MZNnSUIcSyLMgYRqNfav1', 'V719StdNeaONVJbg3iX25X5670sWyWWwZWYgJYEIYPKSXfI6pQuxu9jF', 'CqEIOTKT22I1I4uHbbUs3VbONxFkTxWJ9LESUKAdDClu5DnonD04hJn9', 'ZTjyHggJsUJxAQCQSqdwtA0MHsCN8AaI2KHSxNNOUpDRxemOY78QE0e7', 'qzLSp9r3Y6YX1hsrUSXKMvJbxoZhGesmStoZuooY6Zy3y1HpFRnZlPHQ', 'dRTifIhuMX4untF0SZeyukSpdy63Ck5SBOooOMHDS0nxOjMfR88Us43H', 'eUfL4dvqO0ihFJZptqAc6ynEVnxnXBCHP3rbYMrmlHnnCGETbIOhcBsr', 'n6H3gA1VCzzgDAIAuuDAmpq5oAFfglG6HYIxlW8EeriiHhmoV2Qpqpep'
Source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.cs	High entropy of concatenated method names: '_6R9honep9Q8eNg9wARu2CxfZzQA7tmHpyjLnG1lRtiZ9HeOupft2BvngKPmAxjKoiKLuuCSWtbFAHRXCf8cvSY8D', 'j9GqnvN2L46twQJS9tIoq87b8um7b4U1xmslatuYbEGrSUtxzwTxyDP4ilDYqpb3HvZylBhQsr', 'ZSkqGJMDnmujgo7UORaxccfIfin76euDMm9gzmNgoZzZMiok059speRmekYABH2eE4b7nO072m', 'ltJMOWlfwBblpJ2y4KlR8TlGGQfrAMs0XRtdQ2YyMwueDGbqEcB8HdLuMmG92XpBH12gnxh1JP', '_0hHubFKJV1w2GXnk243jP14ZJMLBCp7jk5xGxszM3C8JshBZdCFVuE2xk5jTDtR8fomP3ziCMi', 'xqRv7SyYJPujqdreAdBCUySC6QHiZlp6GfyEyQrhlW2hKdhsGmkJMMOrJOZYwHC5ofUnlp7moL', 'JHCYE7XA9LlDbd5safZBX6SR6ro4c3HG9jAZqukr2detWdKLjk3VPd8atGgIir9D85XSUFIgvx', 'NDmyOdePDqhRJGznyiBg6X6fnk4TsGP1J3DO2FOoCQZ5Omd3Yw4WgpvKbDdTFGiLBqimYDLV15', 'tIeaWxATc7ukxLfQA3JwBLtNThXJ0Q6NIZhP7UNPgabzCmPzn8bfWdwNlOftps6z9guhk9qM4u', 'wcgtDaSeJHxSrzkZMCmVpSisUMqsT5EntvCZq6oBxd4o6XoNKzHaYclAPCog5yU2yCDTcAL7Eg'
Source: Teams.exe.4.dr, 8geLz7PVJDaHJbPqbQcZhNJgzEYf94XxUjqToyM7ntcdaErGYo85BKZd5IU2rTC2VTHwDLwlQR.cs	High entropy of concatenated method names: 'uQRqgRCZAI2DLD4VZztwHIa2xB7rcn4KBVvQgd8wntRPFcfChBEcM1MVLyk1oWiCJZ70ydYESo', 'P9ClOHa4rdlhCfAL', '_8O7FpOeok5QJPY2M', '_1Lh7vxdiNyOh4xplo71TKYxNTFIluIVOdhgkI2kfZvRRbHrCbHo', '_17nP4NzneHKSpy6pdgPpVs7ZVeLImiBE03PwZzVyFOeJmLyQo4A', '_2mtUAoy1PpsiO3a6WVS8vt4JDEVD6fxsxWYi6aEpmrWCYQHgtW9', 'pF0gZckkZIhzsVx8qS6ryFY5k8F3PISS4xCzcIHphArwL78x5uS', 'ptccob2gnTJGPvhwotnNYcEmx8rlLfXz1cVD12PL9rDzLzTSpBU', 'zBVEIMs6Brz10OdxLT3NXvSU2g4J7CEA9FDwgYrdgnawBQG4rTV', '_1mI298zT5Ncrgaymc6Yxjf5pBTYy9wM3OxHSc8YHTfSfmeeLOtn'
Source: Teams.exe.4.dr, Uc3BjQmcdurs1N4Pk8uOPT3r.cs	High entropy of concatenated method names: 'LIQW8jYDJQYI4x5LlOPgbwhMaU9LQZ7njJyJjpby9nf9nSTzsOsoRMg0OtuQLuK8lEirs3ldOSC2uWYxgeZAnavitIg', 'uobLoYbpfOS2gFExFHNEl8xGtAAhONvvRiCcHvgCFKMGtxQcaxXRNayXrW2QtQtnsySAsXAimlV0JGehwzWqx5B5dDz', '_3ecpUmWdVZGLbB0HkWul2MUlQYx1flc6FmIUw7Pb1oMKyYssKy155wOBju2Nc5M7K7NCjL0A5MENiKSVIBGbXbuV0ZL', 'V6fkO4govhkzWuUWVVoIjmI1ysVqLZkDT9uxhlwqGWFs6ZuFZbvmNQinxkFpJWQcQ6g2z2oyZ48q0UMKTQ5KV004UDZ'
Source: Teams.exe.4.dr, jo5XtzA2m7JH1S9wBz7M2Z2mAmU9QBxH2A204V.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'Nj1K87Wq3d1jNDDqPZjSrXrWJIEAIOR3yPogCdBsWvxZtNR27HRfQNQF2FTTffK3tgITmjEiJWbdvszUkVAfEKTMRW4', 'yEMLQpTfjLhInCdYYjQeD01R2ZzocmV6v6t9mmWd1x1ebbTvOPluqqukwGkykoNP5zKe8SEEuKog7MTqYu63O3Zl6vO', 'Ok9lHapzpi5sNXQa1mmnoTA01HV46aEsCody8fBndwLXXtIqA7HhIiBp52zYZzprXM7k9wdIzlcgKqIpa7PyUlr4lnO', 'GcTJqnh5FCcyKu1r3YdH0TUpnTNdFE3sZnXENtKsLoZQ3KzyjKe8vOnXVooloZxJJvmzWUoM1vUkaIx3XbtKa4KkXJs'
Source: Teams.exe.4.dr, algSkwMmgudIic5cQ2Q90SqIDKwJWCDnrXTAUds3tNLiPAxSvcXsAcPV.cs	High entropy of concatenated method names: 'Znz1YJbjDstF3NnCtce9JA5rvdCTEIiVIaYeZby890EK9ogT5gc2hzIF', 'QH6BzTzzL1KqBZpIuFs51GiP0ooeey6t2gKmhw3JQMHBFhQBGCZ3vouD', 'peMVjIfxwRiF2zyIqbgXQr6yKGk0owQXCDxTpQL9Z8hwkbnP7xj35HQi', 'kI7NpaySKqRsWiRSd3wfgM0ynfPtM0NheDNeyKxRYDIorB8zvn26XV5N', 'Bo6RAokTurylQeyxBlbnaZgIIMOSLrb34Q6zYsN2ptxKbE46iggr8VBw', 'OTNoPcpn2FUWyPDUtNdNRTmCkjpseegnxdLsmvo3P43zxFLHsUM53v49', 'mUFbQRip6QDF2MCeKJyOgcnLUqjGmtuiLz3IAZae3wkqsiYxgbFQAYqQ', 'cT1goHaztVDbTi5lLou7fesoYqqqEhqodRKbs2lXLZsZIFFIiXd7EY0J', 'L4TKjPPvq2gqLdM9k3xyfBKjnDE7n3TiUxJqsWgPBROsQe3stiAea1yB01EnnliWftDCpfu0VdflOiL13RZIU15L', '_9B0s2RQ36gmV2Q7g8v77F7Ln3jUnJJVSivs9mjErF27Nr3ttqayNn48AoF66CaizfjJzbGf6OORwXlCPkJ3PuUOS'
Source: Teams.exe.4.dr, uC4bX9qmnfDttpZXgexIMCB3.cs	High entropy of concatenated method names: 'nNtoatmovcCMfktBBqWvVSlu', 'qbFH3Tk9ffXeadnS69DVF7F5', 'dPovAIFp4d38VfpIQHRkmd1T', 'TiIJNIcbO0Rlt6or7mWc8LfIqGb5xfaBEAagpmE6qAaJqi7ffsTVpQH34YsEH1Y4xSGTy39zzlPGVQ6af8cihl5uUCh', 'LUFgBfZwnUGTK5yaCcpctVmaqlanJq3IYhXgie53Xlw11AzOQM7p64nZFQpy5UFxqNEHfngHC1lMFHBFS52Oy1tOnIi', 'ubtNdMj2CpELyOwKdi58UGLE4yqjfou62', '_9Vg6xoiOBscSTkOZTFie5VKcMSobDzt0Z', 'elcLxLdMPUAQ3Z4XJ7ywr2Yw8aYdV7JV9', 'vKJ0EB23zmyxiqi7HlrqIKpUHkujCDkmA', 'Rg8qNclJhsV9fzncMtsxK5qLYWrUYh7xZ'
Source: Teams.exe.4.dr, vPNx814kaDySqqPhZPNlS3exd80mmXA9ptWc7VoO4zvsTK1evI9iBv81QuL59JyYJiuTuLTbA3G76EYcMcVv9q40.cs	High entropy of concatenated method names: 'l5MJF0vpQPJbUi71eFmUKTDhTY4Qwe877PvKoC4AB6JDQknrfFUaw5kyeV94CdnFoqksQtX0GQ8QEYntElP6ZGb3', 'xadeNV33MWKl5ms8jqjZD0kspA3zgxSwbqWBtzJxU6XbnTGvM34bwTXaWXiyVs9zx8lgDH0khvtWJnMAmEyyEAW7', 'v9Fj1jch3K7q7vFQqK7wFPKgbAnehIAhCz8Bh2DxhbL683MRLRzJHam7PDCl3bx6vbipxIQiHeNng9VQVOlkhnIP', '_6EuL6rtRB2wxtDPigGvSJbVeyp7pubSTB77yoqQConnyxAoW0wQTN8KAYeSEjhgJPpJjp0KF6mqGVobSQ7D2tGWp', 'LDpI5pYf8eFqUamVqoHXHCf2xu5xRJ0TnSxKgGT8NJnAYoAd3rMerMdnXjrMBQLwLO', 'SW1VEzjRrMzvE2DQ4CHJRnoiBROVSOA7d91fahrwhV6Wu7yLgyGjTln6cOrKyoDnpY', 'BFXzEZCS9KAUMQtzWacglUUPkQ8LEgIgF9x0rqf853IdpbStbEsMC17IKVqIUOxdmL', 'SbMmqA7RXo3F7ufyItURyE8Sd2IOxhQkxP3TYPHS3wGO4PxwAQ63iw8MT62C8F5NMH', 'ljxl7SDLTB17wg7T5Ic8GdBUbXVhBjihDIKIhpl3RmPHEnSk1R53dDpyVK5LPAfqIh', '_7rm44ml0UApjPS3xuApn44aaFRMyvyrroQ4Pplt5cSVI1xVsfobeyw9NgNGQHnclMB'
Source: Teams.exe.4.dr, AxNLL2qwxotWTTDijmh3abU9Hb1wEfkrtuIE6gqinoCcVgRHPXqDrnQS8dNmaPvOvMUEfjVeA48bXQTvWiwwN4WG.cs	High entropy of concatenated method names: 'HVSotpCw10PcbHgH9MuOwxBcgfITzdLTTkFSvkAnRDpyHer2YKJxFb5ShJdlTEfmscttiby0r648GMSbrsEqtsh8', 'nLQlpxLvvbz4mtmEKujPJRdNfjBt1YkPOHgjdI4EuCuMksAfG0ioZznbhFSj1hCg7v', 'M1Bqx7EqAQj3oJy1AKG54GtNfEKET3XOGHpEQ3NOQInnGBvLho3N57KtyR4tzXUeYj', 'JgdyLHTGtqhT4a8wZFflZhwR849GQTDNS7txbK23bJFSdynkSnASKK3jUkE0sdUePE', 'hOfK58Hbm0QmouKpxdtOmEf3AxUNgHQoi5SOdBSLPV1lHQXH8R0PSWEGls0HbM1jec'
Source: Teams.exe.4.dr, galkvGG8EiPIcJR8LGppC8UxAdk7MX8S4JE18u0WRgtlYT5nELAVXthyxxBMjLf5FGgVcaoSmNKYAFZkLood1AVt.cs	High entropy of concatenated method names: 'Uf2T3bngWgeL4s5tZ70Gst0sZnfSOh5PiGIYyOwkvUwYr4h59ysCFYiWsV6Wt1cxb8p3lRHWNi4Wb01Re3Zozthj', 'XirxY2rgKavEADTJ9Z7Rl9PebpLHA3QarbS38VBW3WoPJrzUTHPHPJqa6oGqbFV3l1', '_3NCMA70TImJrlux0OjR4S5Yv71eKKLSccNkydVtkHQ88P2gVV3zE7BgVZa5071FGft', 'lX0Qi7Vnt7Gn31KeOBq1ucH2GHjMhsBzYONHsrYgq3xhrWlAxC5i2eKOskyFrCUEhF', 'ptyEPlCXtr4k3Cnim1ABAKZ5LG1H3vhWAd7ztgAxcZTHxSz6a32MwDPfvbx6in1oA9'
Source: Teams.exe.4.dr, F5vMHDl0yhQPqFo1H7ie55ng.cs	High entropy of concatenated method names: 'xCYvtnsP0UJSi3tqykECf0HF', 'RguiYWheTClE8b3yzBgXHLe0', 'wPzOcYqjLN91bmwgFWMVfVlLwYhmcpZCuL6MZNnSUIcSyLMgYRqNfav1', 'V719StdNeaONVJbg3iX25X5670sWyWWwZWYgJYEIYPKSXfI6pQuxu9jF', 'CqEIOTKT22I1I4uHbbUs3VbONxFkTxWJ9LESUKAdDClu5DnonD04hJn9', 'ZTjyHggJsUJxAQCQSqdwtA0MHsCN8AaI2KHSxNNOUpDRxemOY78QE0e7', 'qzLSp9r3Y6YX1hsrUSXKMvJbxoZhGesmStoZuooY6Zy3y1HpFRnZlPHQ', 'dRTifIhuMX4untF0SZeyukSpdy63Ck5SBOooOMHDS0nxOjMfR88Us43H', 'eUfL4dvqO0ihFJZptqAc6ynEVnxnXBCHP3rbYMrmlHnnCGETbIOhcBsr', 'n6H3gA1VCzzgDAIAuuDAmpq5oAFfglG6HYIxlW8EeriiHhmoV2Qpqpep'
Source: Teams.exe.4.dr, TyafYnZPI0nJXPTq2UgLGtZqQDMh54kIos4pBXVn6y77XaZixzdS2r7q5swYgLkLGFOLjzSv936fQcHXuWyjgjZY.cs	High entropy of concatenated method names: '_6R9honep9Q8eNg9wARu2CxfZzQA7tmHpyjLnG1lRtiZ9HeOupft2BvngKPmAxjKoiKLuuCSWtbFAHRXCf8cvSY8D', 'j9GqnvN2L46twQJS9tIoq87b8um7b4U1xmslatuYbEGrSUtxzwTxyDP4ilDYqpb3HvZylBhQsr', 'ZSkqGJMDnmujgo7UORaxccfIfin76euDMm9gzmNgoZzZMiok059speRmekYABH2eE4b7nO072m', 'ltJMOWlfwBblpJ2y4KlR8TlGGQfrAMs0XRtdQ2YyMwueDGbqEcB8HdLuMmG92XpBH12gnxh1JP', '_0hHubFKJV1w2GXnk243jP14ZJMLBCp7jk5xGxszM3C8JshBZdCFVuE2xk5jTDtR8fomP3ziCMi', 'xqRv7SyYJPujqdreAdBCUySC6QHiZlp6GfyEyQrhlW2hKdhsGmkJMMOrJOZYwHC5ofUnlp7moL', 'JHCYE7XA9LlDbd5safZBX6SR6ro4c3HG9jAZqukr2detWdKLjk3VPd8atGgIir9D85XSUFIgvx', 'NDmyOdePDqhRJGznyiBg6X6fnk4TsGP1J3DO2FOoCQZ5Omd3Yw4WgpvKbDdTFGiLBqimYDLV15', 'tIeaWxATc7ukxLfQA3JwBLtNThXJ0Q6NIZhP7UNPgabzCmPzn8bfWdwNlOftps6z9guhk9qM4u', 'wcgtDaSeJHxSrzkZMCmVpSisUMqsT5EntvCZq6oBxd4o6XoNKzHaYclAPCog5yU2yCDTcAL7Eg'

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\AppData\Roaming\XClient.exe	File created: C:\Users\user\AppData\Roaming\Teams.exe	Jump to dropped file
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	File created: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Jump to dropped file
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	File created: C:\Users\user\AppData\Roaming\XClient.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\XClient.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Teams" /tr "C:\Users\user\AppData\Roaming\Teams.exe"

Source: C:\Users\user\AppData\Roaming\XClient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Teams.lnk

Source: C:\Users\user\AppData\Roaming\XClient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Teams.lnk

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\XClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Teams			Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Teams			Jump to behavior

Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Memory allocated: 1620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Memory allocated: 1AFA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Memory allocated: 1E6EBDA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Memory allocated: 1E6EDAE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1B160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 1AA20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 1AF10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 1210000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 1A9F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 1560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 1AEE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 11B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 1AE70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: B30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 1A900000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 690000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Teams.exe	Memory allocated: 1A1E0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598521	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598382	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598266	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597934	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597329	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597204	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597079	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596583	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596339	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596073	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595793	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594829	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594204	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594079	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 593954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 593829	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 593704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Window / User API: threadDelayed 4143	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Window / User API: threadDelayed 5650	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Window / User API: threadDelayed 7359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Window / User API: threadDelayed 2495	Jump to behavior

Source: C:\Users\user\Desktop\kwlYObMOSn.exe TID: 5028	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -598657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -598521s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -598382s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -598266s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -598141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -597934s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -597704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -597579s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -597454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -597329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -597204s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -597079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -596954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -596829s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -596704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -596583s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -596454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -596339s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -596219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -596073s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -595793s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -595563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -595438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -595079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -594954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -594829s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -594704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -594579s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -594454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -594329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -594204s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -594079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -593954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -593829s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe TID: 5960	Thread sleep time: -593704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 6196	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe TID: 2924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe TID: 1856	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe TID: 5536	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Teams.exe TID: 3524	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Teams.exe TID: 2124	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Teams.exe TID: 5256	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Teams.exe TID: 5032	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Teams.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Teams.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Teams.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Teams.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598521	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598382	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598266	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597934	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597329	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597204	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 597079	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596583	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596339	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 596073	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595793	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594829	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594204	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 594079	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 593954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 593829	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Thread delayed: delay time: 593704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Teams.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: kwlYObMOSn.exe, 00000000.00000002.2052402034.0000000001256000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.14.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: BootstrapperV1.23.exe, 00000002.00000002.2547110487.000001E6EBE1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.14.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin`
Source: XClient.exe, 00000004.00000002.4506642415.000000001C130000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW"/>
Source: Amcache.hve.14.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: XClient.exe, 00000004.00000002.4501579682.0000000001460000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.14.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Teams.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\kwlYObMOSn.exe

Memory allocated: page read and write | page guard

Yara detected Powershell download and execute

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: Process Memory Space: BootstrapperV1.23.exe PID: 2860, type: MEMORYSTR
Source: Yara match	File source: \Device\ConDrv, type: DROPPED

Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process created: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe "C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Teams" /tr "C:\Users\user\AppData\Roaming\Teams.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior

Source: C:\Users\user\Desktop\kwlYObMOSn.exe	Queries volume information: C:\Users\user\Desktop\kwlYObMOSn.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Queries volume information: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Queries volume information: C:\Users\user\AppData\Roaming\Teams.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Queries volume information: C:\Users\user\AppData\Roaming\Teams.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Teams.exe	Queries volume information: C:\Users\user\AppData\Roaming\Teams.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Teams.exe	Queries volume information: C:\Users\user\AppData\Roaming\Teams.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Teams.exe	Queries volume information: C:\Users\user\AppData\Roaming\Teams.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Teams.exe	Queries volume information: C:\Users\user\AppData\Roaming\Teams.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Teams.exe	Queries volume information: C:\Users\user\AppData\Roaming\Teams.exe VolumeInformation

Source: C:\Users\user\Desktop\kwlYObMOSn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: XClient.exe, 00000004.00000002.4501579682.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000004.00000002.4501579682.00000000014C3000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000004.00000002.4506642415.000000001C130000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000004.00000002.4506642415.000000001C1BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 4.0.XClient.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kwlYObMOSn.exe.2fc4d38.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kwlYObMOSn.exe.2fd5778.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.2051658508.0000000000F22000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2053142429.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kwlYObMOSn.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 5428, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Teams.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 4.0.XClient.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kwlYObMOSn.exe.2fc4d38.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kwlYObMOSn.exe.2fd5778.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kwlYObMOSn.exe.2fd5778.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kwlYObMOSn.exe.2fc4d38.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.2051658508.0000000000F22000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2053142429.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kwlYObMOSn.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 5428, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Teams.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	141 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	13 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
kwlYObMOSn.exe	68%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
kwlYObMOSn.exe	100%	Avira	TR/Dropper.Gen
kwlYObMOSn.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Teams.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Roaming\XClient.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Roaming\Teams.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\XClient.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	63%	ReversingLabs	Win64.Trojan.Heracles
C:\Users\user\AppData\Roaming\Teams.exe	83%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\user\AppData\Roaming\XClient.exe	83%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label
https://discord.com;http://127.0.0.1:6463/rpc?v=11	0%	Avira URL Cloud	safe
http://127.0.0.1:64632	0%	Avira URL Cloud	safe
Cactus-33152.portmap.host	100%	Avira URL Cloud	malware
https://fdf3b68c.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	100%	Avira URL Cloud	malware
https://fdf3b68c.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
Cactus-33152.portmap.host	193.161.193.99	true	true	unknown
nodejs.org	104.20.23.46	true	false	high
getsolara.dev	172.67.203.125	true	false	high
www.nodejs.org	104.20.22.46	true	false	high
edge-term4-lhr2.roblox.com	128.116.119.3	true	false	high
clientsettings.roblox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
Cactus-33152.portmap.host	true	Avira URL Cloud: malware	unknown
https://getsolara.dev/asset/discord.json	false		high
https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live	false		high
https://getsolara.dev/api/endpoint.json	false		high
https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:6463	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E6800FF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.nodejs.org	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nodejs.org	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E680001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ncs.roblox.com/upload	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E680117000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E680179000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.nodejs.org	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.14.dr	false		high
http://james.newtonking.com/projects/json	BootstrapperV1.23.exe.0.dr	false		high
http://getsolara.dev	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E6800B5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com;http://127.0.0.1:6463/rpc?v=11	BootstrapperV1.23.exe, 00000002.00000000.2050063683.000001E6EBAA2000.00000002.00000001.01000000.00000006.sdmp, BootstrapperV1.23.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/vs/17/release/vc_redist.x64.exe	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000000.2050063683.000001E6EBAA2000.00000002.00000001.01000000.00000006.sdmp, BootstrapperV1.23.exe.0.dr	false		high
https://fdf3b68c.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E6800D2000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68017D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gitlab.com/cmd-softworks1/a/-/snippets/4768754/raw/main/endpoint.json	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E680117000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000000.2050063683.000001E6EBAA2000.00000002.00000001.01000000.00000006.sdmp, BootstrapperV1.23.exe.0.dr	false		high
http://edge-term4-lhr2.roblox.com	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getsolara.dev	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E6800AA000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E680117000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/cmd-softworks1/a/-/snippets/4768756/raw/main/discord.json	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E680001000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000000.2050063683.000001E6EBAA2000.00000002.00000001.01000000.00000006.sdmp, BootstrapperV1.23.exe.0.dr	false		high
http://127.0.0.1:64632	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E6800FF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.newtonsoft.com/jsonschema	BootstrapperV1.23.exe.0.dr	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	BootstrapperV1.23.exe, 00000002.00000000.2050063683.000001E6EBAA2000.00000002.00000001.01000000.00000006.sdmp, BootstrapperV1.23.exe.0.dr	false		high
http://nodejs.org	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:6463/rpc?v=1	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E680001000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E6800FF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68009A000.00000004.00000800.00020000.00000000.sdmp, XClient.exe, 00000004.00000002.4502717565.0000000003161000.00000004.00000800.00020000.00000000.sdmp	false		high
http://clientsettings.roblox.com	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E680117000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E680175000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/pjseRvyK	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E680117000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000000.2050063683.000001E6EBAA2000.00000002.00000001.01000000.00000006.sdmp, BootstrapperV1.23.exe.0.dr	false		high
https://clientsettings.roblox.com	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fdf3b68c.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68019F000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.23.exe, 00000002.00000002.2545484392.000001E68017D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.203.125	getsolara.dev	United States	13335	CLOUDFLARENETUS	false
193.161.193.99	Cactus-33152.portmap.host	Russian Federation	198134	BITREE-ASRU	true
128.116.119.3	edge-term4-lhr2.roblox.com	United States	22697	ROBLOX-PRODUCTIONUS	false
104.20.22.46	www.nodejs.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561585
Start date and time:	2024-11-23 20:59:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kwlYObMOSn.exe renamed because original name is a hash value
Original Sample Name:	3914bb7ca015e96eb45556b7fa427a8b5fbfc497a9909b777ea5d4e5b321111e.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@22/13@5/5
EGA Information:	Successful, ratio: 10%
HCA Information:	Successful, ratio: 97% Number of executed functions: 231 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BootstrapperV1.23.exe, PID 2860 because it is empty
Execution Graph export aborted for target Teams.exe, PID 1892 because it is empty
Execution Graph export aborted for target Teams.exe, PID 3288 because it is empty
Execution Graph export aborted for target Teams.exe, PID 4196 because it is empty
Execution Graph export aborted for target Teams.exe, PID 5168 because it is empty
Execution Graph export aborted for target Teams.exe, PID 5988 because it is empty
Execution Graph export aborted for target Teams.exe, PID 6112 because it is empty
Execution Graph export aborted for target Teams.exe, PID 6172 because it is empty
Execution Graph export aborted for target kwlYObMOSn.exe, PID 4080 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: kwlYObMOSn.exe

Simulations

Behavior and APIs

Time	Type	Description
15:00:05	API Interceptor	13749857x Sleep call for process: XClient.exe modified
15:00:06	API Interceptor	72x Sleep call for process: BootstrapperV1.23.exe modified
15:00:49	API Interceptor	1x Sleep call for process: WerFault.exe modified
21:00:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Teams C:\Users\user\AppData\Roaming\Teams.exe
21:00:07	Task Scheduler	Run new task: Teams path: C:\Users\user\AppData\Roaming\Teams.exe
21:00:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Teams C:\Users\user\AppData\Roaming\Teams.exe
21:00:21	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Teams.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.203.125	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse
193.161.193.99	Yq5Gp2g2vB.exe	Get hash	malicious	RedLine	Browse	okmaq-24505.portmap.host:24505/
	JnBNepHH7K.exe	Get hash	malicious	AsyncRAT RedLine	Browse	exara32-64703.portmap.host:64703/
	99SKW728vf.exe	Get hash	malicious	RedLine	Browse	lottie9nwtina-55339.portmap.host:55339/
	amazoninvoiceAF0388d83739dee83479171dbcf.exe	Get hash	malicious	RedLine	Browse	tete2792-22120.portmap.host:22120//
128.116.119.3	bootstraper.exe	Get hash	malicious	Unknown	Browse
	bootstraper.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse
	https://roblox.com.zm/games/10449761463/The-Strongest-Battlegrounds?privateServerLinkCode=22919554639422626360922039380445	Get hash	malicious	Unknown	Browse
	https://shrturl.net/pmf-gx3n	Get hash	malicious	Unknown	Browse
	RFAwChXSve.exe	Get hash	malicious	DCRat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.nodejs.org	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	104.20.22.46
	KKjubdmzCR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	AYUGPPBj0x.exe	Get hash	malicious	DCRat	Browse	104.20.23.46
	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	104.20.23.46
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	104.20.23.46
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
getsolara.dev	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	104.21.93.27
	KKjubdmzCR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.93.27
	AYUGPPBj0x.exe	Get hash	malicious	DCRat	Browse	104.21.93.27
	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	172.67.203.125
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
nodejs.org	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	104.20.22.46
	KKjubdmzCR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	AYUGPPBj0x.exe	Get hash	malicious	DCRat	Browse	104.20.23.46
	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	104.20.23.46
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	104.20.23.46
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.20.22.46

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITREE-ASRU	https://fxwf9-53194.portmap.io:53194/?x=sb232111	Get hash	malicious	Unknown	Browse	193.161.193.99
	invoice263886766 AWB.vbs	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	193.161.193.99
	https://E.vg/FoedcaVhT	Get hash	malicious	Unknown	Browse	193.161.193.99
	meN9qeS2DE.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	iLPxdpxQ3e.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	JJSPLOIT.V2.exe	Get hash	malicious	Quasar	Browse	193.161.193.99
	FudAm.bat	Get hash	malicious	Quasar	Browse	193.161.193.99
	runme.bat	Get hash	malicious	Quasar	Browse	193.161.193.99
	Am.ps1	Get hash	malicious	Quasar	Browse	193.161.193.99
	1.ps1	Get hash	malicious	Quasar	Browse	193.161.193.99
ROBLOX-PRODUCTIONUS	bootstraper.exe	Get hash	malicious	Unknown	Browse	128.116.119.3
	bootstraper.exe	Get hash	malicious	Unknown	Browse	128.116.119.3
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	128.116.123.3
	KKjubdmzCR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	128.116.123.3
	AYUGPPBj0x.exe	Get hash	malicious	DCRat	Browse	128.116.44.3
	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse	128.116.44.4
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	128.116.123.4
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	128.116.110.16
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	128.116.21.4
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	128.116.123.4
CLOUDFLARENETUS	https://www.google.co.kr/url?url=https://hrtyuytitwagtxswxzqxpcm&jtdm=hjstxxb&qhwocq=elw&vrszx=mrursi&rtz=qksmlok&sdyxm=kxlpun&hnkj=iujyvng&vochgqf=ylsd&pkhfd=vyifcj&nymdhak=ffn&ylzv=xpddvxaj&zoadnebgoj=rccejsmuqd&q=amp/hmf1bnz.s%C2%ADlf%C2%ADpg%C2%ADq%C2%ADq%C2%ADwzu%C2%ADx%C2%ADppns%C2%ADc%C2%ADs%C2%AD.com%E2%80%8B/n7brnx1iy&lbgq=ihcrvpx&isffrcc=xjcvvbbd&hokv=buitobfj&nfzezydbgm=lhtjhglyxx&pjwu=tdsgcse&cesnzrb=ekoykarj&ifpv=yabmwecd&acyeqkflup=bacwibnnwl&dovx=vqvcdxk&rwbvdtj=khlezois&efgx=ktfpexjt&iqggbgjmwh=cvqmvfdelx&gqsh=ghsdgye&hipceti=hpqeesqk&hkvbucxuvo=drwoirzwsq&dril=qbpemxo&xziwtam=tdvywqlj&nndiwyldry=kjqbehmdbj&kqef=faiqetj&peigggc=vbyfdxky&fstmbbtmkx=rjxugltfmc&rpws=borxqez&rijvxqj=ntedqhtd&wohxxxgtmq=jpiozpkrbp&cxah=gcmtksp&tzidqah=syxnwioo&szzishkfke=xmnmodwwoc&xmif=xdxtrqz&ajzcojq=fmtqkshw&gkmh=vmwdknp&xvlhpuf=zkhqqziq&rvfh=igbqint&gdnzlky=hyzlhjke&dqkq=ophpttl&yoamsuz=cuykisoc&frzr=lajcnwi&chdmjpw=hymhkhbw&wnxy=zwkomqb&duxkrfq=asjrwcgu&fzya=hrpcnke&hxrusxm=foudbois&yqgm=uhfvxoo&uynyplq=iryzkatx&qfzs=stmleud&vkbxzkf=hxgbjzit&dnro=vjxntck&kfrldgj=vpyfihbn&nsko=sdzidzb&unudtuz=mnvrwokv&lisf=zxdfari&tdyzrah=otrtzuun&rfza=trokalr&vkfduyc=wpwvnxpe&jjsq=pgkbofh&uatnbjp=gtwiypfq&zilu=kagobvs&jqfufkw=bckrzetp&tjng=jgmmmod&fvdtpsk=vlyzfjep&mgoi=fklhysh&llyljdv=jxpogtdn&gcjv=vjlzkuf&erlhvti=peuprtov&kbxk=jviffkg&lklbxhl=uhzpnzfw&upaw=gfmiehp&ismxijp=hmwbsmgj&zdkc=kodikna&njllvzf=oodglyrw&urdk=cktezyn&vmqhwgh=kqcbhffu&riqy=tlnbqzr&nmlgrkn=inyeynzg&vebu=pwpghzr&ckpmyoc=tmeufjen&otic=svrqsdo&tbwzub	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	cmd.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://elizgallery.com/nazvanie.js	Get hash	malicious	Unknown	Browse	104.22.0.204
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	https://myqrcode.mobi/qr/3c3aa5e1/view	Get hash	malicious	Unknown	Browse	172.67.20.8

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.67.203.125 128.116.119.3 104.20.22.46
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	172.67.203.125 128.116.119.3 104.20.22.46
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	172.67.203.125 128.116.119.3 104.20.22.46
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.203.125 128.116.119.3 104.20.22.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.67.203.125 128.116.119.3 104.20.22.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.67.203.125 128.116.119.3 104.20.22.46
	17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Get hash	malicious	XWorm	Browse	172.67.203.125 128.116.119.3 104.20.22.46
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.203.125 128.116.119.3 104.20.22.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.67.203.125 128.116.119.3 104.20.22.46
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.203.125 128.116.119.3 104.20.22.46

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse
C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe	KKjubdmzCR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BootstrapperV1.2_b3bef142175e2c9feedfe8f06a73673fcbfff2_9c4008b6_55181495-87bb-4c66-9a44-3854d34aea5d\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2671348489429193
Encrypted:	false
SSDEEP:	192:H1wgcswr0bU9+dQVaWxejol2/fsLzuiFvZ24lO8F:OgcsPbG+dQVaml23sLzuiFvY4lO8F
MD5:	98CDE6EACCCBD6E095E2E545F945BFE7
SHA1:	E8774E2ED387E7FB226A4781F0DD4E452068B76A
SHA-256:	D9C4EAE29A26D430BDA2C776CC5B7B1C9F32677D0F48E98B612478DF33E62E22
SHA-512:	C52AE114C82720A3A1C23D596B73C05B1E90F3CF35DEF8DAF82CB7749E9901812864B5FDEE3BDBD2487ECFBC3B268567744FD9BAA118FC8B7285CF940D790B6F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.8.6.5.6.1.5.0.7.9.1.4.0.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.8.6.5.6.1.6.2.6.6.6.2.3.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.5.1.8.1.4.9.5.-.8.7.b.b.-.4.c.6.6.-.9.a.4.4.-.3.8.5.4.d.3.4.a.e.a.5.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.4.d.6.d.1.e.a.-.1.1.f.1.-.4.2.e.3.-.9.5.4.d.-.f.3.6.0.2.8.f.5.d.9.d.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.B.o.o.t.s.t.r.a.p.p.e.r.V.1...2.3...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.o.l.a.r.a.B.o.o.t.s.t.r.a.p.p.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.2.c.-.0.0.0.1.-.0.0.1.4.-.0.4.6.f.-.8.0.4.7.e.2.3.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.f.e.1.7.3.6.3.1.c.a.d.c.4.a.7.6.9.5.d.3.9.9.5.7.a.1.2.d.e.9.c.0.0.0.0.0.0.0.0.!.0.0.0.0.3.0.2.3.1.a.4.6.7.a.4.9.c.c.3.7.7.6.8.e.e.a.0.f.5.5.f.4.b.e.a.1.c.b.f.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9337.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sat Nov 23 20:00:15 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	603646
Entropy (8bit):	3.307347295263333
Encrypted:	false
SSDEEP:	6144:yfyDzrySV6kN8OvtKdqyuyq3IpA2OiK0nAc3QK/P:y8rySV46yq3IpA2OizQ
MD5:	1CF39890037C7C4017E35D7566788C2E
SHA1:	FA9BBB18E2BFDD4FB629BF0C2FB85AF5B8C794CB
SHA-256:	639053F7FDAC259CA802D40975E941A3A603C36BD20D6531E15FC6233AA126B2
SHA-512:	9A81D37C7CCE43EDCF46A06319DEBE7AC2B76E222F7FAAE08E4E78F13607D2F16948A8B86CEC7B28A1108AB7E548567206367DB9BFA16CACC3B0EA8578E910A8
Malicious:	false
Preview:	MDMP..a..... .......O4Bg............4...........<...T.......<....)...........)......tT..............l.......8...........T............V...............E...........G..............................................................................eJ......dH......Lw......................T.......,...@4Bg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9701.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6824
Entropy (8bit):	3.7187814624713535
Encrypted:	false
SSDEEP:	192:R6l7wVeJQVZio5gbYZK8Ypru89baCUfsem:R6lXJyZiUgbYAJapfc
MD5:	342E319241D85DE8AF523DED652C0C72
SHA1:	77396E79DC66DC75DDAC61265E3FDCE7612C91D6
SHA-256:	FE07ADB460C4859283FA9A2054B7689EB9BB771103D574C20B485AF2E6CBE8BC
SHA-512:	82DF750482004E3EDDF12A1D01B6FEAEFDBBE0DC06DA822F22E9F9BCC15493FED41DFF476BF57A80F90258BAFE2CFE44215D8BBA6063A2569162C10FC45F963A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9731.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4834
Entropy (8bit):	4.464854798453406
Encrypted:	false
SSDEEP:	48:cvIwWl8zs0Jg771I9pOWpW8VY3Ym8M4JQKy/FMNlyq8vay4Dx5b5Ud:uIjfyI7mv7VbJzWGf1Ud
MD5:	C2B14730949DC8304808266C5785100F
SHA1:	E2D3CA390F32DE893A461301F6CF3DEB383D91B4
SHA-256:	4F5DB76274A7E33C7C2AEBBA28F5B2B7725C89847A55A6BB2E3809DE85866ADA
SHA-512:	CD43810FC93035201FC1850E951C2CCD788460702A303299E830CE797F97FC4846B63FD777EB3FECACB3898A68B9339E1F5FFA0A4204C8B9CB8E455890179B5A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="601142" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Teams.exe.log

Process:	C:\Users\user\AppData\Roaming\Teams.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\kwlYObMOSn.exe.log

Process:	C:\Users\user\Desktop\kwlYObMOSn.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe

Process:	C:\Users\user\Desktop\kwlYObMOSn.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	819200
Entropy (8bit):	5.598261375667174
Encrypted:	false
SSDEEP:	12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
MD5:	02C70D9D6696950C198DB93B7F6A835E
SHA1:	30231A467A49CC37768EEA0F55F4BEA1CBFB48E2
SHA-256:	8F2E28588F2303BD8D7A9B0C3FF6A9CB16FA93F8DDC9C5E0666A8C12D6880EE3
SHA-512:	431D9B9918553BFF4F4A5BC2A5E7B7015F8AD0E2D390BB4D5264D08983372424156524EF5587B24B67D1226856FC630AACA08EDC8113097E0094501B4F08EFEB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: 8Hd0ZExgJz.exe, Detection: malicious, Browse Filename: KKjubdmzCR.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....5g.........."......v............... ....@...... ....................................`.................................................4...T.......u............................................................................................ ..H............text....t... ...v.................. ..`.rsrc...u............x..............@..@.reloc...............~..............@..BH...........\|............................................................0..R.......(....:....r...p(....r...po....:-...r-..pr&..p.. (.....@....r...pr<..p(....(....&.......0..........rL..prT..p.(....s....%.o....%.o....%.o....%.o.....s.......o.....o....&.o....o......(....9.....o....o.............9.....o.............8.8p.......0..8.......r\..p.......%...%.r^..p.%...%.r...p.%...%.r...p.(...........(....~....%:....&~.........s....%.....(...+...0..l.........(....r...p(....(....r\..p.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Teams.lnk

Process:	C:\Users\user\AppData\Roaming\XClient.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Nov 23 19:00:05 2024, mtime=Sat Nov 23 19:00:05 2024, atime=Sat Nov 23 19:00:05 2024, length=68096, window=hide
Category:	dropped
Size (bytes):	753
Entropy (8bit):	5.00342396501985
Encrypted:	false
SSDEEP:	12:8b04f+88CQTlsY//49ESLAItXZClWUjAMHENlWtmxMxfmV:8RfF8lZwmsAqslWAA7NlWtSEfm
MD5:	9A1C13C1DFEAC2E49524050A020BD8EE
SHA1:	98B322C0AAC3D3878086E5E99A19E2B453B3E581
SHA-256:	827618C840CB935EFFEEF5250C80F520D80F988EB133CE9198D2149C146C3B03
SHA-512:	43021A195DEF58249A7750DD35BE88F5FB66BC8C633A004E016B042E4EF37069311FF5667A9CDBAC627BC7B43A5EA8BE73CB00BD6B8217513AFA3E72CA1B496C
Malicious:	false
Preview:	L..................F.... ...2~.J.=..2~.J.=..2~.J.=..........................p.:..DG..Yr?.D..U..k0.&...&...... M.......BC.=....GJ.=......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSlwY}.....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....wY....Roaming.@......DWSlwY......C........................R.o.a.m.i.n.g.....\.2.....wY.. .Teams.exe.D......wY..wY...... ......................(o.T.e.a.m.s...e.x.e.......X...............-.......W............E......C:\Users\user\AppData\Roaming\Teams.exe........\.....\.....\.....\.....\.T.e.a.m.s...e.x.e.`.......X.......784794...........hT..CrF.f4... ...2=.b...,...W..hT..CrF.f4... ...2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Teams.exe

Process:	C:\Users\user\AppData\Roaming\XClient.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.020738658795511
Encrypted:	false
SSDEEP:	1536:0QPbpWkVHai1Ub2rFRIdxRmKVMKokb4R9rAooBsh6bgOP+l:0QDpWk6Jb6+xVMKokb4RndOP+l
MD5:	E82A4E80B783AB902E649D21DCD0F3D5
SHA1:	DD32A84C4BFF58262FECB1511FBDBECDAC2B8045
SHA-256:	63988792736CC57B3B93735662A660A4229D76E487D3D59ABC0AE17BC05050A5
SHA-512:	51E5CA643E3E7576F073207EE854B10CF9DC61434670D20AFE771AAAFBBD883FF5A09CC471C5B5E2334BE5FF4C8E83B32722E7A8F29F5C61379B225191E98F98
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\Teams.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\Teams.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&.6g................................. ... ....@.. .......................`............@.................................X...S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......,X..,.......&.....................................................(.....r...p. .#....(.....r#..p. S....s.........s.........s.........s..........r...p. .W...r...p.rN..p. ..9..r...p. ..%..r...p. .x!...((....rS..p. .O...r...p. p.+.&(....&+..+5sR... .... .'..oS...(...~....-.(A...(3...~....oT...&.-..r{..p. ..Q..r4..p. p{..r...p. o....r1..p. .V................j..................sU.............."(C...+.:.t....(>...+..r{..p. .(T..r...p*.

C:\Users\user\AppData\Roaming\XClient.exe

Process:	C:\Users\user\Desktop\kwlYObMOSn.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.020738658795511
Encrypted:	false
SSDEEP:	1536:0QPbpWkVHai1Ub2rFRIdxRmKVMKokb4R9rAooBsh6bgOP+l:0QDpWk6Jb6+xVMKokb4RndOP+l
MD5:	E82A4E80B783AB902E649D21DCD0F3D5
SHA1:	DD32A84C4BFF58262FECB1511FBDBECDAC2B8045
SHA-256:	63988792736CC57B3B93735662A660A4229D76E487D3D59ABC0AE17BC05050A5
SHA-512:	51E5CA643E3E7576F073207EE854B10CF9DC61434670D20AFE771AAAFBBD883FF5A09CC471C5B5E2334BE5FF4C8E83B32722E7A8F29F5C61379B225191E98F98
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&.6g................................. ... ....@.. .......................`............@.................................X...S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......,X..,.......&.....................................................(.....r...p. .#....(.....r#..p. S....s.........s.........s.........s..........r...p. .W...r...p.rN..p. ..9..r...p. ..%..r...p. .x!...((....rS..p. .O...r...p. p.+.&(....&+..+5sR... .... .'..oS...(...~....-.(A...(3...~....oT...&.-..r{..p. ..Q..r4..p. p{..r...p. o....r1..p. .V................j..................sU.............."(C...+.:.t....(>...+..r{..p. .(T..r...p*.

C:\Users\user\Desktop\DISCORD

Process:	C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.081427527984575
Encrypted:	false
SSDEEP:	3:XSWHlkHFWKBgdvHvIhN9GIxFf9oQg652UTF/HLMl1m:XSWHlW0aivQLkWFfx/52uyPm
MD5:	B016DAFCA051F817C6BA098C096CB450
SHA1:	4CC74827C4B2ED534613C7764E6121CEB041B459
SHA-256:	B03C8C2D2429E9DBC7920113DEDF6FC09095AB39421EE0CC8819AD412E5D67B9
SHA-512:	D69663E1E81EC33654B87F2DFADDD5383681C8EBF029A559B201D65EB12FA2989FA66C25FA98D58066EAB7B897F0EEF6B7A68FA1A9558482A17DFED7B6076ACA
Malicious:	false
Preview:	{. "args" : {. "code" : "8PgspRYAQu". },. "cmd" : "INVITE_BROWSER",. "nonce" : ".". }

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421796526248881
Encrypted:	false
SSDEEP:	6144:8Svfpi6ceLP/9skLmb0OT5WSPHaJG8nAgeMZMMhA2fX4WABlEnNE0uhiTw:nvloT5W+EZMM6DFyK03w
MD5:	81A1AA30793DD8171DDB48E3695E336C
SHA1:	CE3A89F8B7ED7728A8411D7FFFE11667F622DB07
SHA-256:	4D5D6EB65BD43D5F68F21A4A450AB3ECACBCA3E037E0537A739B9C70DD6D79BA
SHA-512:	070F4EE46A5D7F8FCC2A682F60EBFCE44E63A4450CBD2D25D2C066924D488912A229EF517EBA8EC0216C50B1807969C681E0CB0CAD920B148E3CCE3AE424378A
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmF..O.=...............................................................................................................................................................................................................................................................................................................................................G.{........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Process:	C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	571
Entropy (8bit):	4.9398118662542965
Encrypted:	false
SSDEEP:	12:t+3p+t/hQAOfVaOQsXCzLQ8X+UwkY1v3igBe:Yot/h+ltcQy+UwkY1vdBe
MD5:	5294778E41EE83E1F1E78B56466AD690
SHA1:	348B8B4687216D57B8DF59BBCEC481DC9D1E61A6
SHA-256:	3AC122288181813B83236E1A2BCB449C51B50A3CA4925677A38C08B2FC6DF69C
SHA-512:	381FB6F3AA34E41C17DB3DD8E68B85508F51A94B3E77C479E40AD074767D1CEAE89B6E04FB7DD3D02A74D1AC3431B30920860A198C73387A865051538AE140F1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: \Device\ConDrv, Author: Joe Security
Preview:	.............................................................------------------------.. ..[-] Fetching endpoint.....[-] Bootstrapper up to date...[-] Killing conflicting processes.....[-] Ensuring essential directories.....[-] Ensuring essential dependencies.....[-] Downloading node......Unhandled Exception: System.Net.WebException: The operation has timed out.. at System.Net.WebClient.DownloadFile(Uri address, String fileName).. at Program.DownloadAndInstallNode().. at Program.EnsureDependencies().. at Program.Main(String[] args).

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.996910042858342
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	kwlYObMOSn.exe
File size:	897'536 bytes
MD5:	f28a1fb54a5c3b2b4e4184e3dff4f50a
SHA1:	180878512f7cd7c75c87fff174203228de688d34
SHA256:	3914bb7ca015e96eb45556b7fa427a8b5fbfc497a9909b777ea5d4e5b321111e
SHA512:	b15a376ed2370dd0c338a6736c450cfb6ae7b670a69e3b54eb2105a19cf6e4b7cecbbed1c96bc91db1653a3106d873f889e5788a83eff874c1341cfd7adc39c4
SSDEEP:	24576:dAt5/Yxh3QlHPSZtbd1aRu8w2BdgXKhzm1OtH6nNnKAAAG/AA14eF0oayiw:m5ucEbr8PgXKhqItH6nNnKAAAG/AA14f
TLSH:	10152359F5F13222EB65EBBF0FF8A9014CF057226203194FF328351D94B55E646BA24E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q.6g................................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4dc6ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67369F71 [Fri Nov 15 01:10:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdc678	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xde000	0x4d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xda6d4	0xda800	63a2167270a33cbff4f34a97e2c9500d	False	0.9395816200657895	data	7.998505878740895	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xde000	0x4d0	0x600	184937c6229aad767aedda4cfa4a4f16	False	0.375	data	3.7002969536945476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe0000	0xc	0x200	0cf50d5b905ebadd8448137df7b814a8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xde0a0	0x23c	data			0.4772727272727273
RT_MANIFEST	0xde2e0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T21:00:09.122437+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49707	172.67.203.125	443	TCP
2024-11-23T21:01:12.622457+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	49850	193.161.193.99	33152	TCP
2024-11-23T21:02:40.792427+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	50028	193.161.193.99	33152	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 21:00:03.299864054 CET	49704	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:03.299899101 CET	443	49704	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:03.299959898 CET	49704	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:03.445008039 CET	49704	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:03.445030928 CET	443	49704	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:04.765207052 CET	443	49704	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:04.765346050 CET	49704	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:04.771785975 CET	49704	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:04.771801949 CET	443	49704	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:04.772037983 CET	443	49704	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:04.812753916 CET	49704	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:04.828233957 CET	49704	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:04.871335983 CET	443	49704	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:05.262703896 CET	443	49704	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:05.262813091 CET	443	49704	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:05.262887001 CET	49704	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:05.279489040 CET	49704	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:07.261588097 CET	49706	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:07.348407030 CET	49707	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:07.348470926 CET	443	49707	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:07.348553896 CET	49707	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:07.349716902 CET	49707	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:07.349747896 CET	443	49707	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:07.386845112 CET	33152	49706	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:07.386962891 CET	49706	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:07.514628887 CET	49706	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:07.636244059 CET	33152	49706	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:08.615365028 CET	443	49707	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:08.615477085 CET	49707	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:08.617176056 CET	49707	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:08.617225885 CET	443	49707	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:08.617475986 CET	443	49707	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:08.672152042 CET	49707	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:08.701483965 CET	49707	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:08.747332096 CET	443	49707	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:09.122443914 CET	443	49707	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:09.122570992 CET	443	49707	172.67.203.125	192.168.2.5
Nov 23, 2024 21:00:09.122631073 CET	49707	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:09.123128891 CET	49707	443	192.168.2.5	172.67.203.125
Nov 23, 2024 21:00:09.606074095 CET	33152	49706	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:09.606162071 CET	49706	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:09.704185963 CET	49708	443	192.168.2.5	128.116.119.3
Nov 23, 2024 21:00:09.704221010 CET	443	49708	128.116.119.3	192.168.2.5
Nov 23, 2024 21:00:09.704307079 CET	49708	443	192.168.2.5	128.116.119.3
Nov 23, 2024 21:00:09.704593897 CET	49708	443	192.168.2.5	128.116.119.3
Nov 23, 2024 21:00:09.704610109 CET	443	49708	128.116.119.3	192.168.2.5
Nov 23, 2024 21:00:11.225498915 CET	443	49708	128.116.119.3	192.168.2.5
Nov 23, 2024 21:00:11.225619078 CET	49708	443	192.168.2.5	128.116.119.3
Nov 23, 2024 21:00:11.228952885 CET	49708	443	192.168.2.5	128.116.119.3
Nov 23, 2024 21:00:11.228965998 CET	443	49708	128.116.119.3	192.168.2.5
Nov 23, 2024 21:00:11.229217052 CET	443	49708	128.116.119.3	192.168.2.5
Nov 23, 2024 21:00:11.270900965 CET	49708	443	192.168.2.5	128.116.119.3
Nov 23, 2024 21:00:11.315331936 CET	443	49708	128.116.119.3	192.168.2.5
Nov 23, 2024 21:00:11.859807968 CET	49706	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:11.862204075 CET	49709	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:11.971838951 CET	443	49708	128.116.119.3	192.168.2.5
Nov 23, 2024 21:00:11.971924067 CET	443	49708	128.116.119.3	192.168.2.5
Nov 23, 2024 21:00:11.971987009 CET	49708	443	192.168.2.5	128.116.119.3
Nov 23, 2024 21:00:11.972378016 CET	49708	443	192.168.2.5	128.116.119.3
Nov 23, 2024 21:00:11.981117010 CET	33152	49706	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:11.982709885 CET	33152	49709	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:11.982791901 CET	49709	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:11.998296022 CET	49709	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:12.122009039 CET	33152	49709	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:13.660742044 CET	49710	443	192.168.2.5	104.20.22.46
Nov 23, 2024 21:00:13.660794020 CET	443	49710	104.20.22.46	192.168.2.5
Nov 23, 2024 21:00:13.660954952 CET	49710	443	192.168.2.5	104.20.22.46
Nov 23, 2024 21:00:13.661197901 CET	49710	443	192.168.2.5	104.20.22.46
Nov 23, 2024 21:00:13.661216974 CET	443	49710	104.20.22.46	192.168.2.5
Nov 23, 2024 21:00:14.240144014 CET	33152	49709	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:14.240221024 CET	49709	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:14.939510107 CET	443	49710	104.20.22.46	192.168.2.5
Nov 23, 2024 21:00:14.939584970 CET	49710	443	192.168.2.5	104.20.22.46
Nov 23, 2024 21:00:14.941447973 CET	49710	443	192.168.2.5	104.20.22.46
Nov 23, 2024 21:00:14.941458941 CET	443	49710	104.20.22.46	192.168.2.5
Nov 23, 2024 21:00:14.941822052 CET	443	49710	104.20.22.46	192.168.2.5
Nov 23, 2024 21:00:14.943999052 CET	49710	443	192.168.2.5	104.20.22.46
Nov 23, 2024 21:00:14.991355896 CET	443	49710	104.20.22.46	192.168.2.5
Nov 23, 2024 21:00:15.516002893 CET	49709	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:15.517836094 CET	49711	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:15.642441988 CET	33152	49709	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:15.644200087 CET	33152	49711	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:15.644282103 CET	49711	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:15.658325911 CET	443	49710	104.20.22.46	192.168.2.5
Nov 23, 2024 21:00:15.658463955 CET	443	49710	104.20.22.46	192.168.2.5
Nov 23, 2024 21:00:15.658519983 CET	49710	443	192.168.2.5	104.20.22.46
Nov 23, 2024 21:00:15.658898115 CET	49710	443	192.168.2.5	104.20.22.46
Nov 23, 2024 21:00:15.703146935 CET	49711	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:15.822837114 CET	33152	49711	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:17.871303082 CET	33152	49711	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:17.873156071 CET	49711	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:19.186677933 CET	49711	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:19.191452980 CET	49715	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:19.306468964 CET	33152	49711	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:19.311083078 CET	33152	49715	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:19.311211109 CET	49715	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:19.630975008 CET	49715	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:19.752804995 CET	33152	49715	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:21.521542072 CET	33152	49715	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:21.521755934 CET	49715	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:23.392069101 CET	49715	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:23.394730091 CET	49727	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:23.511732101 CET	33152	49715	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:23.514270067 CET	33152	49727	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:23.514410019 CET	49727	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:23.534077883 CET	49727	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:23.654139042 CET	33152	49727	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:25.771286964 CET	33152	49727	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:25.771368980 CET	49727	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:26.734819889 CET	49727	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:26.736030102 CET	49734	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:26.968583107 CET	33152	49727	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:26.968615055 CET	33152	49734	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:26.968794107 CET	49734	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:27.000791073 CET	49734	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:27.120539904 CET	33152	49734	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:29.187747002 CET	33152	49734	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:29.188133001 CET	49734	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:31.891154051 CET	49734	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:31.893466949 CET	49745	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:32.017563105 CET	33152	49734	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:32.020026922 CET	33152	49745	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:32.020153999 CET	49745	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:32.055676937 CET	49745	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:32.175298929 CET	33152	49745	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:34.322139025 CET	33152	49745	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:34.323489904 CET	49745	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:36.203557014 CET	49745	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:36.205538034 CET	49757	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:36.324210882 CET	33152	49745	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:36.326049089 CET	33152	49757	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:36.326167107 CET	49757	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:36.342494011 CET	49757	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:36.462790012 CET	33152	49757	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:38.575720072 CET	33152	49757	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:38.575850010 CET	49757	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:40.719305038 CET	49757	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:40.720619917 CET	49770	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:40.845870018 CET	33152	49757	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:40.847115993 CET	33152	49770	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:40.847230911 CET	49770	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:40.865673065 CET	49770	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:40.987579107 CET	33152	49770	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:43.147207022 CET	33152	49770	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:43.147402048 CET	49770	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:45.172965050 CET	49770	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:45.174609900 CET	49783	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:45.298563957 CET	33152	49770	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:45.300383091 CET	33152	49783	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:45.300467968 CET	49783	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:45.319127083 CET	49783	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:45.445641994 CET	33152	49783	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:47.506131887 CET	33152	49783	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:47.506221056 CET	49783	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:48.552093983 CET	49783	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:48.567024946 CET	49790	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:48.674752951 CET	33152	49783	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:48.689627886 CET	33152	49790	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:48.689727068 CET	49790	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:48.765028954 CET	49790	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:48.891381979 CET	33152	49790	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:51.044101954 CET	33152	49790	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:51.044169903 CET	49790	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:52.266100883 CET	49790	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:52.267388105 CET	49803	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:52.388396978 CET	33152	49790	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:52.389782906 CET	33152	49803	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:52.389852047 CET	49803	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:52.405474901 CET	49803	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:52.529812098 CET	33152	49803	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:54.559479952 CET	33152	49803	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:54.559575081 CET	49803	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:55.219149113 CET	49803	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:55.220257044 CET	49809	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:55.340595007 CET	33152	49803	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:55.341862917 CET	33152	49809	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:55.344110012 CET	49809	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:55.358158112 CET	49809	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:55.651221037 CET	33152	49809	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:57.772011042 CET	33152	49809	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:57.773206949 CET	49809	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:57.878268957 CET	49809	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:57.879410028 CET	49815	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:57.997936964 CET	33152	49809	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:57.998982906 CET	33152	49815	193.161.193.99	192.168.2.5
Nov 23, 2024 21:00:57.999082088 CET	49815	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:58.014273882 CET	49815	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:00:58.140716076 CET	33152	49815	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:00.262073040 CET	33152	49815	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:00.262259960 CET	49815	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:01.469096899 CET	49815	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:01.470441103 CET	49827	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:01.589571953 CET	33152	49815	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:01.590214014 CET	33152	49827	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:01.590316057 CET	49827	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:01.604844093 CET	49827	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:01.724407911 CET	33152	49827	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:03.818872929 CET	33152	49827	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:03.818943024 CET	49827	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:03.844400883 CET	49827	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:03.846652985 CET	49833	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:03.989620924 CET	33152	49827	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:03.989640951 CET	33152	49833	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:03.989732027 CET	49833	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:04.007136106 CET	49833	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:04.126966953 CET	33152	49833	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:06.200140953 CET	33152	49833	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:06.200223923 CET	49833	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:06.859869003 CET	49833	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:06.860991955 CET	49839	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:06.980654001 CET	33152	49833	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:06.981775999 CET	33152	49839	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:06.981854916 CET	49839	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:06.996658087 CET	49839	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:07.121910095 CET	33152	49839	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:09.356677055 CET	33152	49839	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:09.356787920 CET	49839	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:09.609901905 CET	49839	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:09.610963106 CET	49845	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:09.734100103 CET	33152	49839	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:09.735075951 CET	33152	49845	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:09.735163927 CET	49845	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:09.751357079 CET	49845	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:09.870971918 CET	33152	49845	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:11.975301027 CET	33152	49845	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:11.975450993 CET	49845	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:11.984908104 CET	49845	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:11.988428116 CET	49850	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:12.104592085 CET	33152	49845	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:12.108231068 CET	33152	49850	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:12.108923912 CET	49850	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:12.136013031 CET	49850	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:12.255645037 CET	33152	49850	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:12.622457027 CET	49850	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:12.774574995 CET	33152	49850	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:14.319156885 CET	33152	49850	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:14.319384098 CET	49850	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:17.922445059 CET	49850	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:17.926841974 CET	49863	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:18.042232037 CET	33152	49850	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:18.046396971 CET	33152	49863	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:18.047405005 CET	49863	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:18.243248940 CET	49863	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:18.363203049 CET	33152	49863	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:20.216532946 CET	33152	49863	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:20.223373890 CET	49863	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:23.422841072 CET	49863	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:23.425652981 CET	49878	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:23.545886040 CET	33152	49863	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:23.548445940 CET	33152	49878	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:23.548543930 CET	49878	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:23.577423096 CET	49878	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:23.716734886 CET	33152	49878	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:25.781775951 CET	33152	49878	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:25.781963110 CET	49878	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:28.938066959 CET	49878	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:28.940043926 CET	49891	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:29.058788061 CET	33152	49878	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:29.060421944 CET	33152	49891	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:29.060520887 CET	49891	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:29.095881939 CET	49891	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:29.218436956 CET	33152	49891	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:29.218511105 CET	49891	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:29.338110924 CET	33152	49891	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:31.335202932 CET	33152	49891	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:31.335278034 CET	49891	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:34.220731974 CET	49891	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:34.220973969 CET	49902	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:34.340869904 CET	33152	49891	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:34.341259956 CET	33152	49902	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:34.344465017 CET	49902	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:34.529293060 CET	49902	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:34.648889065 CET	33152	49902	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:36.577519894 CET	33152	49902	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:36.577629089 CET	49902	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:39.598490000 CET	49902	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:39.647177935 CET	49916	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:39.724705935 CET	33152	49902	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:39.772231102 CET	33152	49916	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:39.772381067 CET	49916	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:39.960097075 CET	49916	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:40.079791069 CET	33152	49916	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:41.982325077 CET	33152	49916	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:41.985441923 CET	49916	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:45.047614098 CET	49916	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:45.048935890 CET	49929	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:45.169524908 CET	33152	49916	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:45.170958996 CET	33152	49929	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:45.171041965 CET	49929	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:45.208410025 CET	49929	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:45.329502106 CET	33152	49929	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:47.413651943 CET	33152	49929	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:47.413877010 CET	49929	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:50.456245899 CET	49929	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:50.470392942 CET	49940	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:50.577608109 CET	33152	49929	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:50.589993000 CET	33152	49940	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:50.593511105 CET	49940	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:50.852737904 CET	49940	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:50.972702980 CET	33152	49940	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:50.972774982 CET	49940	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:51.092622995 CET	33152	49940	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:51.092693090 CET	49940	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:51.217437029 CET	33152	49940	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:51.217515945 CET	49940	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:51.344166040 CET	33152	49940	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:52.786143064 CET	33152	49940	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:52.786243916 CET	49940	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:56.206248999 CET	49953	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:56.206259966 CET	49940	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:56.332783937 CET	33152	49953	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:56.332824945 CET	33152	49940	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:56.333478928 CET	49953	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:56.385385990 CET	49953	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:01:56.607283115 CET	33152	49953	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:58.773209095 CET	33152	49953	193.161.193.99	192.168.2.5
Nov 23, 2024 21:01:58.773411036 CET	49953	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:01.500602007 CET	49953	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:01.504160881 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:01.644845009 CET	33152	49953	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:01.644889116 CET	33152	49966	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:01.645215034 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:01.773494005 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:01.927239895 CET	33152	49966	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:02.767220974 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:02.887109995 CET	33152	49966	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:02.887157917 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:03.008790970 CET	33152	49966	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:03.008857012 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:03.128547907 CET	33152	49966	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:03.128609896 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:03.248270988 CET	33152	49966	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:03.248328924 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:03.368107080 CET	33152	49966	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:03.610661983 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:03.731745958 CET	33152	49966	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:04.086576939 CET	33152	49966	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:04.086720943 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:08.156769991 CET	49966	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:08.159075022 CET	49981	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:08.283191919 CET	33152	49966	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:08.459579945 CET	33152	49981	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:08.459676981 CET	49981	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:08.527379990 CET	49981	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:08.647099972 CET	33152	49981	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:10.807389975 CET	33152	49981	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:10.807471991 CET	49981	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:13.625562906 CET	49981	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:13.628334045 CET	49993	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:13.796082973 CET	33152	49981	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:13.796106100 CET	33152	49993	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:13.799978018 CET	49993	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:13.926516056 CET	49993	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:14.046093941 CET	33152	49993	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:16.123604059 CET	33152	49993	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:16.123902082 CET	49993	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:18.985049009 CET	49993	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:18.987931013 CET	50004	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:19.104815006 CET	33152	49993	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:19.107449055 CET	33152	50004	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:19.107522011 CET	50004	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:19.147490025 CET	50004	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:19.269813061 CET	33152	50004	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:19.269881010 CET	50004	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:19.391911983 CET	33152	50004	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:21.352081060 CET	33152	50004	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:21.352161884 CET	50004	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:24.235146999 CET	50004	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:24.237607002 CET	50015	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:24.354706049 CET	33152	50004	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:24.357326984 CET	33152	50015	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:24.357467890 CET	50015	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:24.465492964 CET	50015	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:24.643404961 CET	33152	50015	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:26.601911068 CET	33152	50015	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:26.602031946 CET	50015	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:29.688163996 CET	50015	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:29.689789057 CET	50026	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:29.818505049 CET	33152	50015	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:29.818536043 CET	33152	50026	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:29.818629026 CET	50026	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:29.932665110 CET	50026	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:30.052321911 CET	33152	50026	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:30.078922987 CET	50026	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:30.201303959 CET	33152	50026	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:30.204071045 CET	50026	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:30.323843002 CET	33152	50026	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:32.030174017 CET	33152	50026	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:32.033607006 CET	50026	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:34.953902960 CET	50026	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:34.956784010 CET	50027	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:35.074821949 CET	33152	50026	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:35.077553034 CET	33152	50027	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:35.077656984 CET	50027	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:35.119874954 CET	50027	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:35.246279001 CET	33152	50027	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:35.246352911 CET	50027	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:35.372697115 CET	33152	50027	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:35.372764111 CET	50027	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:35.497040987 CET	33152	50027	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:35.497102976 CET	50027	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:35.616898060 CET	33152	50027	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:37.290007114 CET	33152	50027	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:37.290160894 CET	50027	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:40.438198090 CET	50027	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:40.445549965 CET	50028	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:40.564450979 CET	33152	50027	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:40.572083950 CET	33152	50028	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:40.573617935 CET	50028	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:40.672575951 CET	50028	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:40.792367935 CET	33152	50028	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:40.792427063 CET	50028	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:40.913609982 CET	33152	50028	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:40.913670063 CET	50028	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:41.033386946 CET	33152	50028	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:41.033443928 CET	50028	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:41.153031111 CET	33152	50028	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:42.868109941 CET	33152	50028	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:42.868191957 CET	50028	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:46.065466881 CET	50028	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:46.068265915 CET	50029	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:46.185097933 CET	33152	50028	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:46.187803984 CET	33152	50029	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:46.188467979 CET	50029	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:46.246493101 CET	50029	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:46.368263960 CET	33152	50029	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:48.390034914 CET	33152	50029	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:48.390237093 CET	50029	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:51.328849077 CET	50029	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:51.331342936 CET	50030	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:51.473354101 CET	33152	50029	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:51.473391056 CET	33152	50030	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:51.473465919 CET	50030	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:51.509715080 CET	50030	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:51.661333084 CET	33152	50030	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:51.661432028 CET	50030	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:51.782529116 CET	33152	50030	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:52.563518047 CET	50030	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:52.683114052 CET	33152	50030	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:53.686988115 CET	33152	50030	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:53.687838078 CET	50030	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:56.643618107 CET	50030	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:56.648034096 CET	50031	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:56.765019894 CET	33152	50030	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:56.769457102 CET	33152	50031	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:56.773605108 CET	50031	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:56.968343973 CET	50031	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:57.088000059 CET	33152	50031	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:57.088061094 CET	50031	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:57.208074093 CET	33152	50031	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:57.208316088 CET	50031	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:57.328118086 CET	33152	50031	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:57.375945091 CET	50031	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:57.502000093 CET	33152	50031	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:57.502059937 CET	50031	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:57.624116898 CET	33152	50031	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:57.624178886 CET	50031	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:02:57.743736029 CET	33152	50031	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:58.999507904 CET	33152	50031	193.161.193.99	192.168.2.5
Nov 23, 2024 21:02:58.999571085 CET	50031	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:02.578875065 CET	50031	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:02.585643053 CET	50032	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:02.702831984 CET	33152	50031	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:02.708714008 CET	33152	50032	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:02.708848000 CET	50032	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:02.829986095 CET	50032	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:02.952294111 CET	33152	50032	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:02.952367067 CET	50032	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:03.078382969 CET	33152	50032	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:03.078450918 CET	50032	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:03.316735983 CET	33152	50032	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:03.316804886 CET	50032	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:03.436429977 CET	33152	50032	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:04.962121010 CET	33152	50032	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:04.962192059 CET	50032	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:08.047751904 CET	50032	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:08.053644896 CET	50033	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:08.167387009 CET	33152	50032	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:08.173242092 CET	33152	50033	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:08.173381090 CET	50033	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:08.337641001 CET	50033	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:08.464145899 CET	33152	50033	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:09.516854048 CET	50033	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:09.636778116 CET	33152	50033	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:10.415786028 CET	33152	50033	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:10.421657085 CET	50033	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:13.355668068 CET	50033	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:13.359085083 CET	50034	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:13.482037067 CET	33152	50033	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:13.485352039 CET	33152	50034	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:13.485431910 CET	50034	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:13.527534008 CET	50034	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:13.650546074 CET	33152	50034	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:13.650652885 CET	50034	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:13.770186901 CET	33152	50034	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:15.712477922 CET	33152	50034	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:15.712702036 CET	50034	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:18.641690969 CET	50034	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:18.669342995 CET	50035	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:18.761812925 CET	33152	50034	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:18.788932085 CET	33152	50035	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:18.793678045 CET	50035	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:18.872490883 CET	50035	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:18.993046045 CET	33152	50035	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:18.993094921 CET	50035	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:19.114975929 CET	33152	50035	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:20.063421011 CET	50035	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:20.185802937 CET	33152	50035	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:21.000004053 CET	33152	50035	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:21.000072002 CET	50035	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:23.953895092 CET	50035	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:23.957716942 CET	50036	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:24.080616951 CET	33152	50035	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:24.084177017 CET	33152	50036	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:24.084263086 CET	50036	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:24.199932098 CET	50036	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:24.395725965 CET	33152	50036	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:24.594705105 CET	50036	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:24.716893911 CET	33152	50036	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:26.524924040 CET	33152	50036	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:26.525821924 CET	50036	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:29.204215050 CET	50036	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:29.207675934 CET	50037	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:29.345948935 CET	33152	50036	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:29.345962048 CET	33152	50037	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:29.346040964 CET	50037	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:29.384287119 CET	50037	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:29.509097099 CET	33152	50037	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:29.509166002 CET	50037	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:29.631556034 CET	33152	50037	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:29.631618977 CET	50037	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:29.751687050 CET	33152	50037	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:29.751749992 CET	50037	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:29.874330997 CET	33152	50037	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:31.560635090 CET	33152	50037	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:31.560705900 CET	50037	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:34.688357115 CET	50037	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:34.691911936 CET	50038	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:34.811491966 CET	33152	50037	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:34.816422939 CET	33152	50038	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:34.822870970 CET	50038	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:34.890341997 CET	50038	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:35.009902000 CET	33152	50038	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:35.009964943 CET	50038	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:35.129529953 CET	33152	50038	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:37.031842947 CET	33152	50038	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:37.031949997 CET	50038	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:39.969739914 CET	50038	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:39.973766088 CET	50039	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:40.089329004 CET	33152	50038	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:40.093496084 CET	33152	50039	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:40.093880892 CET	50039	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:40.201632023 CET	50039	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:40.370523930 CET	33152	50039	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:42.366164923 CET	33152	50039	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:42.366952896 CET	50039	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:45.328998089 CET	50039	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:45.331741095 CET	50040	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:45.452915907 CET	33152	50039	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:45.455849886 CET	33152	50040	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:45.455925941 CET	50040	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:45.495436907 CET	50040	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:45.615591049 CET	33152	50040	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:45.615643978 CET	50040	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:45.737986088 CET	33152	50040	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:45.738168001 CET	50040	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:45.864496946 CET	33152	50040	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:47.697666883 CET	33152	50040	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:47.697745085 CET	50040	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:50.596823931 CET	50041	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:50.596837044 CET	50040	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:50.716510057 CET	33152	50041	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:50.716532946 CET	33152	50040	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:50.716669083 CET	50041	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:50.800827980 CET	50041	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:50.921355963 CET	33152	50041	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:52.953984022 CET	33152	50041	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:52.954051971 CET	50041	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:55.891460896 CET	50041	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:55.895685911 CET	50042	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:56.011454105 CET	33152	50041	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:56.015459061 CET	33152	50042	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:56.020874023 CET	50042	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:56.076829910 CET	50042	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:03:56.196764946 CET	33152	50042	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:58.259979010 CET	33152	50042	193.161.193.99	192.168.2.5
Nov 23, 2024 21:03:58.261905909 CET	50042	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:01.110373020 CET	50042	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:01.113688946 CET	50043	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:01.230602026 CET	33152	50042	193.161.193.99	192.168.2.5
Nov 23, 2024 21:04:01.234611988 CET	33152	50043	193.161.193.99	192.168.2.5
Nov 23, 2024 21:04:01.234694004 CET	50043	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:01.279756069 CET	50043	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:01.405982971 CET	33152	50043	193.161.193.99	192.168.2.5
Nov 23, 2024 21:04:01.406039000 CET	50043	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:01.530016899 CET	33152	50043	193.161.193.99	192.168.2.5
Nov 23, 2024 21:04:03.448226929 CET	33152	50043	193.161.193.99	192.168.2.5
Nov 23, 2024 21:04:03.448297024 CET	50043	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:06.328991890 CET	50043	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:06.330944061 CET	50044	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:06.452939987 CET	33152	50043	193.161.193.99	192.168.2.5
Nov 23, 2024 21:04:06.455004930 CET	33152	50044	193.161.193.99	192.168.2.5
Nov 23, 2024 21:04:06.455163002 CET	50044	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:06.558173895 CET	50044	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:06.678330898 CET	33152	50044	193.161.193.99	192.168.2.5
Nov 23, 2024 21:04:07.891820908 CET	50044	33152	192.168.2.5	193.161.193.99
Nov 23, 2024 21:04:08.011630058 CET	33152	50044	193.161.193.99	192.168.2.5
Nov 23, 2024 21:04:08.690259933 CET	33152	50044	193.161.193.99	192.168.2.5
Nov 23, 2024 21:04:08.697870970 CET	50044	33152	192.168.2.5	193.161.193.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 21:00:03.150702000 CET	53021	53	192.168.2.5	1.1.1.1
Nov 23, 2024 21:00:03.289911985 CET	53	53021	1.1.1.1	192.168.2.5
Nov 23, 2024 21:00:06.989326000 CET	49453	53	192.168.2.5	1.1.1.1
Nov 23, 2024 21:00:07.254636049 CET	53	49453	1.1.1.1	192.168.2.5
Nov 23, 2024 21:00:09.556058884 CET	53774	53	192.168.2.5	1.1.1.1
Nov 23, 2024 21:00:09.702918053 CET	53	53774	1.1.1.1	192.168.2.5
Nov 23, 2024 21:00:13.519443035 CET	61403	53	192.168.2.5	1.1.1.1
Nov 23, 2024 21:00:13.660063028 CET	53	61403	1.1.1.1	192.168.2.5
Nov 23, 2024 21:00:15.660528898 CET	56819	53	192.168.2.5	1.1.1.1
Nov 23, 2024 21:00:15.801084042 CET	53	56819	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 21:00:03.150702000 CET	192.168.2.5	1.1.1.1	0x3c14	Standard query (0)	getsolara.dev	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:06.989326000 CET	192.168.2.5	1.1.1.1	0xb8b1	Standard query (0)	Cactus-33152.portmap.host	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:09.556058884 CET	192.168.2.5	1.1.1.1	0xdba1	Standard query (0)	clientsettings.roblox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:13.519443035 CET	192.168.2.5	1.1.1.1	0x902c	Standard query (0)	www.nodejs.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:15.660528898 CET	192.168.2.5	1.1.1.1	0x3955	Standard query (0)	nodejs.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 21:00:03.289911985 CET	1.1.1.1	192.168.2.5	0x3c14	No error (0)	getsolara.dev		172.67.203.125	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:03.289911985 CET	1.1.1.1	192.168.2.5	0x3c14	No error (0)	getsolara.dev		104.21.93.27	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:07.254636049 CET	1.1.1.1	192.168.2.5	0xb8b1	No error (0)	Cactus-33152.portmap.host		193.161.193.99	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:09.702918053 CET	1.1.1.1	192.168.2.5	0xdba1	No error (0)	clientsettings.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:00:09.702918053 CET	1.1.1.1	192.168.2.5	0xdba1	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:00:09.702918053 CET	1.1.1.1	192.168.2.5	0xdba1	No error (0)	edge-term4.roblox.com	edge-term4-lhr2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:00:09.702918053 CET	1.1.1.1	192.168.2.5	0xdba1	No error (0)	edge-term4-lhr2.roblox.com		128.116.119.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:13.660063028 CET	1.1.1.1	192.168.2.5	0x902c	No error (0)	www.nodejs.org		104.20.22.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:13.660063028 CET	1.1.1.1	192.168.2.5	0x902c	No error (0)	www.nodejs.org		104.20.23.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:15.801084042 CET	1.1.1.1	192.168.2.5	0x3955	No error (0)	nodejs.org		104.20.23.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:00:15.801084042 CET	1.1.1.1	192.168.2.5	0x3955	No error (0)	nodejs.org		104.20.22.46	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

getsolara.dev

clientsettings.roblox.com

www.nodejs.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.203.125	443	2860	C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:00:04 UTC	81	OUT	GET /asset/discord.json HTTP/1.1 Host: getsolara.dev Connection: Keep-Alive
2024-11-23 20:00:05 UTC	1021	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:00:05 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"7d966f73b6ce74a610dddaf0d0951ed8" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iHIq1dSxpQXGKiGM1s8%2FnIeocvLXYWmWsoSJ6o4WQjfLT4CdjckIULjcXqGHk8nE4%2FEgXibepvyoQaWtwgtkHqltnloCPuBBCugEKrGI%2FlySaUKFpmS5P%2F41OhPFCHaw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding cf-cache-status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8e73be4f889b8c7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2009&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2813&recv_bytes=695&delivery_rate=1447694&cwnd=191&unsent_bytes=0&cid=8bbd60d4abf029a2&ts=516&x=0"
2024-11-23 20:00:05 UTC	109	IN	Data Raw: 36 37 0d 0a 7b 0a 20 20 20 20 22 61 72 67 73 22 20 3a 20 7b 0a 20 20 20 20 20 20 20 22 63 6f 64 65 22 20 3a 20 22 38 50 67 73 70 52 59 41 51 75 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 63 6d 64 22 20 3a 20 22 49 4e 56 49 54 45 5f 42 52 4f 57 53 45 52 22 2c 0a 20 20 20 20 22 6e 6f 6e 63 65 22 20 3a 20 22 2e 22 0a 20 7d 0d 0a Data Ascii: 67{ "args" : { "code" : "8PgspRYAQu" }, "cmd" : "INVITE_BROWSER", "nonce" : "." }
2024-11-23 20:00:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	172.67.203.125	443	2860	C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:00:08 UTC	56	OUT	GET /api/endpoint.json HTTP/1.1 Host: getsolara.dev
2024-11-23 20:00:09 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:00:08 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"1fb39881d9a29ec7570ef2c2a61f7386" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hyTFDMahSD%2FgJi9bdD64HTva6SP7RzdJHpc44pasRWCEvPBa1nGkDWOB%2BwnKlowJl5IYJ4L46bjbKYp%2BTsK0PgOgBN4J8KPpzEqbL42cXAo2J66e30oP4QdOWBj3GTFJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding cf-cache-status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8e73be679dca7cfa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2408&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2812&recv_bytes=694&delivery_rate=1367041&cwnd=187&unsent_bytes=0&cid=26900a853fd49b23&ts=512&x=0"
2024-11-23 20:00:09 UTC	350	IN	Data Raw: 32 31 63 0d 0a 7b 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 20 22 31 2e 32 33 22 2c 0a 20 20 20 20 22 53 75 70 70 6f 72 74 65 64 43 6c 69 65 6e 74 22 3a 20 22 76 65 72 73 69 6f 6e 2d 38 61 61 33 36 62 62 66 30 65 62 31 34 39 34 61 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 56 65 72 73 69 6f 6e 22 3a 20 22 33 2e 31 32 39 22 2c 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 66 64 66 33 62 36 38 63 2e 73 6f 6c 61 72 61 77 65 62 2d 61 6c 6a 2e 70 61 67 65 73 2e 64 65 76 2f 64 6f 77 6e 6c 6f 61 64 2f 73 74 61 74 69 63 2f 66 69 6c 65 73 2f 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 65 78 65 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 55 72 6c 22 3a 22 68 74 74 70 73 Data Ascii: 21c{ "BootstrapperVersion": "1.23", "SupportedClient": "version-8aa36bbf0eb1494a", "SoftwareVersion": "3.129", "BootstrapperUrl": "https://fdf3b68c.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe", "SoftwareUrl":"https
2024-11-23 20:00:09 UTC	197	IN	Data Raw: 74 70 73 3a 2f 2f 63 6c 69 65 6e 74 73 65 74 74 69 6e 67 73 2e 72 6f 62 6c 6f 78 2e 63 6f 6d 2f 76 32 2f 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 2f 57 69 6e 64 6f 77 73 50 6c 61 79 65 72 2f 63 68 61 6e 6e 65 6c 2f 6c 69 76 65 22 2c 0a 20 20 20 20 22 43 6c 69 65 6e 74 48 61 73 68 22 3a 22 36 62 38 65 38 34 38 34 37 64 38 66 31 37 35 39 32 65 39 66 37 34 63 62 36 34 33 31 65 32 35 32 30 35 66 62 65 65 30 64 31 36 39 39 66 30 62 35 39 39 33 31 39 64 33 39 66 65 38 31 37 34 64 64 22 2c 0a 20 20 20 20 22 43 68 61 6e 67 65 6c 6f 67 22 3a 22 5b 2b 5d 20 75 70 64 61 74 65 64 22 0a 7d 0d 0a Data Ascii: tps://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live", "ClientHash":"6b8e84847d8f17592e9f74cb6431e25205fbee0d1699f0b599319d39fe8174dd", "Changelog":"[+] updated"}
2024-11-23 20:00:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	128.116.119.3	443	2860	C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:00:11 UTC	119	OUT	GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1 Host: clientsettings.roblox.com Connection: Keep-Alive
2024-11-23 20:00:11 UTC	576	IN	HTTP/1.1 200 OK content-length: 119 content-type: application/json; charset=utf-8 date: Sat, 23 Nov 2024 20:00:11 GMT server: Kestrel cache-control: no-cache strict-transport-security: max-age=3600 x-frame-options: SAMEORIGIN roblox-machine-id: e9d3c98b-fed9-008b-41bf-c30ef003f879 x-roblox-region: us-central_rbx x-roblox-edge: lhr2 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://ncs.roblox.com/upload"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1} connection: close
2024-11-23 20:00:11 UTC	119	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 22 30 2e 36 35 32 2e 30 2e 36 35 32 30 37 36 34 22 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 55 70 6c 6f 61 64 22 3a 22 76 65 72 73 69 6f 6e 2d 38 61 61 33 36 62 62 66 30 65 62 31 34 39 34 61 22 2c 22 62 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 22 31 2c 20 36 2c 20 30 2c 20 36 35 32 30 37 36 34 22 7d Data Ascii: {"version":"0.652.0.6520764","clientVersionUpload":"version-8aa36bbf0eb1494a","bootstrapperVersion":"1, 6, 0, 6520764"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	104.20.22.46	443	2860	C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:00:14 UTC	99	OUT	GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1 Host: www.nodejs.org Connection: Keep-Alive
2024-11-23 20:00:15 UTC	497	IN	HTTP/1.1 307 Temporary Redirect Date: Sat, 23 Nov 2024 20:00:15 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=0, must-revalidate location: https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi strict-transport-security: max-age=31536000; includeSubDomains; preload x-vercel-id: iad1::lt48g-1732392015489-4dfa4fa0faf8 CF-Cache-Status: DYNAMIC X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8e73be8f1c6ac34e-EWR
2024-11-23 20:00:15 UTC	20	IN	Data Raw: 66 0d 0a 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 0a 0d 0a Data Ascii: fRedirecting...
2024-11-23 20:00:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:00:00
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\kwlYObMOSn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\kwlYObMOSn.exe"
Imagebase:	0xd00000
File size:	897'536 bytes
MD5 hash:	F28A1FB54A5C3B2B4E4184E3DFF4F50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2053142429.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2053142429.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	15:00:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\BootstrapperV1.23.exe"
Imagebase:	0x1e6ebaa0000
File size:	819'200 bytes
MD5 hash:	02C70D9D6696950C198DB93B7F6A835E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	15:00:01
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	15:00:01
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\XClient.exe"
Imagebase:	0xf20000
File size:	68'096 bytes
MD5 hash:	E82A4E80B783AB902E649D21DCD0F3D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000000.2051658508.0000000000F22000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000000.2051658508.0000000000F22000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	15:00:01
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c ipconfig /all
Imagebase:	0x7ff792b20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	15:00:01
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	15:00:01
Start date:	23/11/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff7b4650000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	8
Start time:	15:00:05
Start date:	23/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Teams" /tr "C:\Users\user\AppData\Roaming\Teams.exe"
Imagebase:	0x7ff70fbd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	15:00:05
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	15:00:07
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Roaming\Teams.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Teams.exe
Imagebase:	0x850000
File size:	68'096 bytes
MD5 hash:	E82A4E80B783AB902E649D21DCD0F3D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\Teams.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\Teams.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	15:00:13
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Roaming\Teams.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Teams.exe"
Imagebase:	0xb90000
File size:	68'096 bytes
MD5 hash:	E82A4E80B783AB902E649D21DCD0F3D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	14
Start time:	15:00:14
Start date:	23/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2860 -s 2196
Imagebase:	0x7ff721450000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	15:00:21
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Roaming\Teams.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Teams.exe"
Imagebase:	0x830000
File size:	68'096 bytes
MD5 hash:	E82A4E80B783AB902E649D21DCD0F3D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	19
Start time:	15:01:01
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Roaming\Teams.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Teams.exe
Imagebase:	0xd10000
File size:	68'096 bytes
MD5 hash:	E82A4E80B783AB902E649D21DCD0F3D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	20
Start time:	15:02:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Roaming\Teams.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Teams.exe
Imagebase:	0xa70000
File size:	68'096 bytes
MD5 hash:	E82A4E80B783AB902E649D21DCD0F3D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	21
Start time:	15:03:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Roaming\Teams.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Teams.exe
Imagebase:	0x5f0000
File size:	68'096 bytes
MD5 hash:	E82A4E80B783AB902E649D21DCD0F3D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	22
Start time:	15:04:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Roaming\Teams.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Teams.exe
Imagebase:	0x50000
File size:	68'096 bytes
MD5 hash:	E82A4E80B783AB902E649D21DCD0F3D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true