Edit tour

Windows Analysis Report
Sldl84wxy8.exe

Overview

General Information

Sample name:	Sldl84wxy8.exe renamed because original name is a hash value
Original sample name:	0b459466e3619d2a29bb93ea2dac077a.exe
Analysis ID:	1417125
MD5:	0b459466e3619d2a29bb93ea2dac077a
SHA1:	b55a18a2d13589b81cae82c691d83e7961799d44
SHA256:	a7adeed2290a6e7d4b061a44337ebbcdc91a9800e40cc96a31632e3e52d710ff
Tags:	32exe
Infos:

Detection

AsyncRAT, VenomRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected AsyncRAT

Yara detected UAC Bypass using CMSTP

Yara detected VenomRAT

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Drops executable to a common third party application directory

Drops large PE files

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses process hollowing technique

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Schtasks From Env Var Folder

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

Sldl84wxy8.exe (PID: 6360 cmdline: "C:\Users\user\Desktop\Sldl84wxy8.exe" MD5: 0B459466E3619D2A29BB93EA2DAC077A)

svchost (3).exe (PID: 6728 cmdline: "C:\Users\user\AppData\Local\Temp\svchost (3).exe" MD5: 8CD2675E19A8B1DCCF0DBF082F42AB33)

RegSvcs.exe (PID: 1548 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 6064 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

WerFault.exe (PID: 1872 cmdline: C:\Windows\system32\WerFault.exe -u -p 6728 -s 1172 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

build.exe (PID: 1036 cmdline: "C:\Users\user\AppData\Local\Temp\build.exe" MD5: 8701FCD188315FA69245FB99E07DF60D)

main.exe (PID: 2036 cmdline: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe MD5: 94F3E2F32CED13FD99CC314BEB587233)

main.exe (PID: 5540 cmdline: "C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 94F3E2F32CED13FD99CC314BEB587233)

main.exe (PID: 5180 cmdline: "C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\main" --mojo-platform-channel-handle=2140 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 94F3E2F32CED13FD99CC314BEB587233)

start.exe (PID: 5652 cmdline: "C:\Users\user\AppData\Local\Temp\start.exe" MD5: C1ADE258F05C512E98EBC4D9D1165F8A)

cmd.exe (PID: 4584 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3800 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 4268 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpC5CE.tmp.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 3848 cmdline: timeout 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

svchos.exe (PID: 3160 cmdline: "C:\Users\user\AppData\Roaming\svchos.exe" MD5: C1ADE258F05C512E98EBC4D9D1165F8A)

svchos.exe (PID: 6536 cmdline: C:\Users\user\AppData\Roaming\svchos.exe MD5: C1ADE258F05C512E98EBC4D9D1165F8A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/ https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: VenomRAT

{"Server": "leetboy.dynuddns.net", "Port": "1339", "Version": "| Edit 3LOSH RAT", "MutexName": "AsyncMutex_6SI8OkPnk", "Autorun": "true", "Group": "true"}

Threatname: AsyncRAT

{"Ports": ["1339"], "Server": ["leetboy.dynuddns.net"], "Mutex": "Exodus_Market", "Certificate": "MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGvapDPbWgjYkLiMw/Vwa3kZRg7kLpXMpzInLQufe7Q587viilcsGDoVXmnf51/SwsKPjSysZUpyayezUlJ1j6aXkZGnasiqJ7iKANdSneQducOn6IwaEuJBmpXKWxhhq8R9JMfiWeOXL/hXoE/wCzwzvU/CrzPXd3uMsLfFMDHZJ+OQ9OXKU/CHZNCgSPs4VSgCgM4eK0YTbu1mLsWSo5th3/ingNFaTyYmGsmLIE2Jq5AR1A+xA+FEdC8zKL1bAwYQcRgIJs7QdedtAIufepPZ9D5HiOiy3ITYVonqwTiiIm20en7UICt+J8iDb4M2Q2iLWA7Yi9PN2cr0Xrs8A4/RL29Qe5Ly2k35i74RiBTiT7Jbl2r7PcYlUGcjTCbdB9PWt3dYaTysuamoq2Zuo2HVRhhoZpwnajS9vNcjuZCYVoQvUQBUnHTeRZrtHXU5JV59ZBlu7flZneMZnbrWXTxob6Bdt8+hrGoSDMWBFcO4jRzhT3hEFUpu4lSFeb9T3Vx4KWkHJhHtMvHuYgDTXERdEcI00sOUbVxgd/62LhGXNNommQKCyiAGj0V5uLD73Fyw8vJpm3jXf3NgNt/CjnlaMc40DJ+HlXE5AgMBAAGjMjAwMB0GA1UdDgQWBBQsT2WvtxGUK29SWs4sHz1xYye0fzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCK5sVfnYyT5MqnCg3uHV2ojf12fIVFCY02Cc7gy3DVoE6/xZCPjr22V/xZunZ7DG1nt0kOJKDwdQYnGoMc5UPh8jbNRoc1ojLOCaluaIYQyl8AGkmUSRA3Ltk0XetDescffrWT/nKuRvIEYU4Ra+B39f8ouGMCa7VXaxnGJ0z0BkUie8KsDLgNmJ7/kVfIYuRxl+YefoCsUTCogqf0fu3DuRHBpUVaSQQOf9YCbvFWH7Nupc3UIwpH5D8kSdpKusEfbRp8nfWN/Fm+lzF3THeHU6vNJ+5UoAWHYFW8wfJCbzQ/0L8QZeOv4uy74oQP2Ed0RdrWCwUL6SSsDPZdDEOy4K4vVYkDTl1nL5tleATguELAEbbT42oLce85z4C7sKvpEfa4DPbU55xBLwvHniILFfjB7VVsrgVckUL/lEf4Y92uJVKvLGruQt/mtKSqIuJjD8T9y7RIsk6g9624egV5UtLtv+36kLKhgIJlqC7Xx/PVwMc2yw8BiQlvxQZgqSd1k7QmV1AhV/3z2wqnYmb09ibTMYaMFjtamFegeFqc4jRLABhVQFEFv8z5E6G9vgKn5mQDWS/JykARBv9o2BjL/PTADfwAtc1b4nWo0l+CI8IjjYXu/mJOuwR+kFJ19INtwbffQvT9U12t4smpcZV+OK0opk4Yr9r1tZYm92ghXA==", "Server Signature": "F0xfEIJ635aPVzJ7TxUSC7Qq0Nvv0T62b4z7CBNsc9ph6RsbFVcdaGd7619j9z8vXELuNb6nAMNzxVh5zw431HAg8uxac4l65Js76iA5ua7oiXIZGJkyHmqqwsGIyAhRfW3MsonOqm07xD5N0vdfHey4r0Vncivg0lzclsA5ofF6Vyle+WewDOLGeL+PH3bGiw9F8dbBeBgH6rdzG7t0OHdgh/32iJ0W9BUzFgjiD7/KZV/QPYXp6Tbh4Mryl4lt9khPn2VmC2eApgyazrOKC5PRUCdNN2J/IPPN3z9F+7nIn/ILSg9vsh5nz/2Zm2/wZ7MqHWvJ9OwxPB1jIs4ojWX4YhQRQkiHSMSC/4aNkvrU+3rMVgLOeieTqhxXnI2G0+wE8pMh5N7fELuZ4oupmAo/Xvbvaaguc2KgGc42OFxAVDJE/pkCg4/wmytoKWH8IEMAd/41qAN22r4qtw95CqhVM6LI6Nqgz3MHHf3fMbkDAbPgOl2z+Hy/gYWl5SMamD6RVWFAC0gDcHpXzFMjzVv5LIuCdaHvFmlDuCUgnezy9oUmMMhEOtOINDtLBS7UoGjYGo2HtI54OJZIDUUHYaD3jIOFaVzq/18l0RKZo8mYWMHwKrdypWpZtd9an1cAHAHb8qmc5Jif/Xajgj4hvCTaGaOOo95NlNeawcWrm1M="}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x947b:$b2: DcRat By qwqdanchun1
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2a2c7:$x1: AsyncRAT 0x2a305:$x1: AsyncRAT

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\start.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Temp\start.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\start.exe	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xc56e:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xf438:$a2: Stub.exe 0xf4c8:$a2: Stub.exe 0x8fdc:$a3: get_ActivatePong 0xc786:$a4: vmware 0xc5fe:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x9ed7:$a6: get_SslClient
C:\Users\user\AppData\Local\Temp\start.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc600:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
C:\Users\user\AppData\Roaming\svchos.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.1498443006.0000000002451000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x209fe:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0000000A.00000002.1498443006.0000000002451000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1e427:$x1: AsyncRAT 0x1e465:$x1: AsyncRAT
0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc400:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000012.00000002.1617321490.0000000002F41000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1e423:$x1: AsyncRAT 0x1e461:$x1: AsyncRAT
0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd37e:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10248:$a2: Stub.exe 0x102d8:$a2: Stub.exe 0x9dec:$a3: get_ActivatePong 0xd596:$a4: vmware 0xd40e:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xace7:$a6: get_SslClient
0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd410:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0000000A.00000002.1497624420.0000000000866000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x3a1d3:$x1: AsyncRAT 0x3a211:$x1: AsyncRAT
00000012.00000002.1605842437.00000000012F7000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xaf4bb:$x1: AsyncRAT 0xaf4f9:$x1: AsyncRAT
Process Memory Space: svchost (3).exe PID: 6728	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: svchost (3).exe PID: 6728	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: svchost (3).exe PID: 6728	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: start.exe PID: 5652	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: start.exe PID: 5652	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: start.exe PID: 5652	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x863e:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x15e69:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2b0f4:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: start.exe PID: 5652	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x81f8:$x1: AsyncRAT 0x822a:$x1: AsyncRAT 0x31500:$x1: AsyncRAT 0x31532:$x1: AsyncRAT 0x15f2f:$s6: VirtualBox 0x2b1ba:$s6: VirtualBox 0x15ee2:$s8: Win32_ComputerSystem 0x2b16d:$s8: Win32_ComputerSystem
Process Memory Space: svchos.exe PID: 6536	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8569:$x1: AsyncRAT 0x859b:$x1: AsyncRAT 0x23645:$x1: AsyncRAT 0x23677:$x1: AsyncRAT
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svchost (3).exe.242314dec30.1.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
2.2.svchost (3).exe.242314dec30.1.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xb330:$q1: Select * from Win32_CacheMemory 0xb370:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xb3be:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xb40c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
2.2.svchost (3).exe.242314ee870.0.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
2.2.svchost (3).exe.242314ee870.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xb330:$q1: Select * from Win32_CacheMemory 0xb370:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xb3be:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xb40c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
10.0.start.exe.250000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
10.0.start.exe.250000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.0.start.exe.250000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xc56e:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xf438:$a2: Stub.exe 0xf4c8:$a2: Stub.exe 0x8fdc:$a3: get_ActivatePong 0xc786:$a4: vmware 0xc5fe:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x9ed7:$a6: get_SslClient
10.0.start.exe.250000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc600:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
10.2.start.exe.2589e10.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
10.2.start.exe.2589e10.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.start.exe.2589e10.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xc56e:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xf438:$a2: Stub.exe 0xf4c8:$a2: Stub.exe 0x8fdc:$a3: get_ActivatePong 0xc786:$a4: vmware 0xc5fe:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x9ed7:$a6: get_SslClient
10.2.start.exe.2589e10.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc600:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
10.2.start.exe.2589e10.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
10.2.start.exe.2589e10.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa76e:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xd638:$a2: Stub.exe 0xd6c8:$a2: Stub.exe 0x71dc:$a3: get_ActivatePong 0xa986:$a4: vmware 0xa7fe:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x80d7:$a6: get_SslClient
10.2.start.exe.2589e10.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa800:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
2.2.svchost (3).exe.242314ee870.0.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
2.2.svchost (3).exe.242314ee870.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd130:$q1: Select * from Win32_CacheMemory 0xd170:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd1be:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd20c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
2.2.svchost (3).exe.242314dec30.1.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
2.2.svchost (3).exe.242314dec30.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd130:$q1: Select * from Win32_CacheMemory 0x1cd70:$q1: Select * from Win32_CacheMemory 0xd170:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x1cdb0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd1be:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x1cdfe:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd20c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x1ce4c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
Click to see the 14 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\start.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\start.exe, ParentProcessId: 5652, ParentProcessName: start.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit, ProcessId: 4584, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' , CommandLine: schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' , CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4584, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' , ProcessId: 3800, ProcessName: schtasks.exe

Snort Signatures

ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT) - Source IP: 94.156.66.112 - Destination IP: 192.168.2.8

Timestamp:	03/28/24-16:25:04.014274
SID:	2850454
Source Port:	4449
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic AsyncRAT Style SSL Cert - Source IP: 185.196.11.223 - Destination IP: 192.168.2.8

Timestamp:	03/28/24-16:25:14.107425
SID:	2035595
Source Port:	1339
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) - Source IP: 185.196.11.223 - Destination IP: 192.168.2.8

Timestamp:	03/28/24-16:25:14.107425
SID:	2030673
Source Port:	1339
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant) - Source IP: 94.156.66.112 - Destination IP: 192.168.2.8

Timestamp:	03/28/24-16:25:04.014274
SID:	2848152
Source Port:	4449
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Sldl84wxy8.exe

Avira: detected

Antivirus detection for URL or domain

Source: leetboy.dynuddns.net

Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\start.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: AsyncRAT {"Ports": ["1339"], "Server": ["leetboy.dynuddns.net"], "Mutex": "Exodus_Market", "Certificate": "MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGvapDPbWgjYkLiMw/Vwa3kZRg7kLpXMpzInLQufe7Q587viilcsGDoVXmnf51/SwsKPjSysZUpyayezUlJ1j6aXkZGnasiqJ7iKANdSneQducOn6IwaEuJBmpXKWxhhq8R9JMfiWeOXL/hXoE/wCzwzvU/CrzPXd3uMsLfFMDHZJ+OQ9OXKU/CHZNCgSPs4VSgCgM4eK0YTbu1mLsWSo5th3/ingNFaTyYmGsmLIE2Jq5AR1A+xA+FEdC8zKL1bAwYQcRgIJs7QdedtAIufepPZ9D5HiOiy3ITYVonqwTiiIm20en7UICt+J8iDb4M2Q2iLWA7Yi9PN2cr0Xrs8A4/RL29Qe5Ly2k35i74RiBTiT7Jbl2r7PcYlUGcjTCbdB9PWt3dYaTysuamoq2Zuo2HVRhhoZpwnajS9vNcjuZCYVoQvUQBUnHTeRZrtHXU5JV59ZBlu7flZneMZnbrWXTxob6Bdt8+hrGoSDMWBFcO4jRzhT3hEFUpu4lSFeb9T3Vx4KWkHJhHtMvHuYgDTXERdEcI00sOUbVxgd/62LhGXNNommQKCyiAGj0V5uLD73Fyw8vJpm3jXf3NgNt/CjnlaMc40DJ+HlXE5AgMBAAGjMjAwMB0GA1UdDgQWBBQsT2WvtxGUK29SWs4sHz1xYye0fzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCK5sVfnYyT5MqnCg3uHV2ojf12fIVFCY02Cc7gy3DVoE6/xZCPjr22V/xZunZ7DG1nt0kOJKDwdQYnGoMc5UPh8jbNRoc1ojLOCaluaIYQyl8AGkmUSRA3Ltk0XetDescffrWT/nKuRvIEYU4Ra+B39f8ouGMCa7VXaxnGJ0z0BkUie8KsDLgNmJ7/kVfIYuRxl+YefoCsUTCogqf0fu3DuRHBpUVaSQQOf9YCbvFWH7Nupc3UIwpH5D8kSdpKusEfbRp8nfWN/Fm+lzF3THeHU6vNJ+5UoAWHYFW8wfJCbzQ/0L8QZeOv4uy74oQP2Ed0RdrWCwUL6SSsDPZdDEOy4K4vVYkDTl1nL5tleATguELAEbbT42oLce85z4C7sKvpEfa4DPbU55xBLwvHniILFfjB7VVsrgVckUL/lEf4Y92uJVKvLGruQt/mtKSqIuJjD8T9y7RIsk6g9624egV5UtLtv+36kLKhgIJlqC7Xx/PVwMc2yw8BiQlvxQZgqSd1k7QmV1AhV/3z2wqnYmb09ibTMYaMFjtamFegeFqc4jRLABhVQFEFv8z5E6G9vgKn5mQDWS/JykARBv9o2BjL/PTADfwAtc1b4nWo0l+CI8IjjYXu/mJOuwR+kFJ19INtwbffQvT9U12t4smpcZV+OK0opk4Yr9r1tZYm92ghXA==", "Server Signature": "F0xfEIJ635aPVzJ7TxUSC7Qq0Nvv0T62b4z7CBNsc9ph6RsbFVcdaGd7619j9z8vXELuNb6nAMNzxVh5zw431HAg8uxac4l65Js76iA5ua7oiXIZGJkyHmqqwsGIyAhRfW3MsonOqm07xD5N0vdfHey4r0Vncivg0lzclsA5ofF6Vyle+WewDOLGeL+PH3bGiw9F8dbBeBgH6rdzG7t0OHdgh/32iJ0W9BUzFgjiD7/KZV/QPYXp6Tbh4Mryl4lt9khPn2VmC2eApgyazrOKC5PRUCdNN2J/IPPN3z9F+7nIn/ILSg9vsh5nz/2Zm2/wZ7MqHWvJ9OwxPB1jIs4ojWX4YhQRQkiHSMSC/4aNkvrU+3rMVgLOeieTqhxXnI2G0+wE8pMh5N7fELuZ4oupmAo/Xvbvaaguc2KgGc42OFxAVDJE/pkCg4/wmytoKWH8IEMAd/41qAN22r4qtw95CqhVM6LI6Nqgz3MHHf3fMbkDAbPgOl2z+Hy/gYWl5SMamD6RVWFAC0gDcHpXzFMjzVv5LIuCdaHvFmlDuCUgnezy9oUmMMhEOtOINDtLBS7UoGjYGo2HtI54OJZIDUUHYaD3jIOFaVzq/18l0RKZo8mYWMHwKrdypWpZtd9an1cAHAHb8qmc5Jif/Xajgj4hvCTaGaOOo95NlNeawcWrm1M="}
Source: 0000000A.00000002.1498443006.0000000002451000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: VenomRAT {"Server": "leetboy.dynuddns.net", "Port": "1339", "Version": "\| Edit 3LOSH RAT", "MutexName": "AsyncMutex_6SI8OkPnk", "Autorun": "true", "Group": "true"}

Multi AV Scanner detection for domain / URL

Source: blue.o7lab.me	Virustotal: Detection: 16%	Perma Link
Source: leetboy.dynuddns.net	Virustotal: Detection: 8%	Perma Link
Source: leetboy.dynuddns.net	Virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\build.exe

Virustotal: Detection: 14%

Perma Link

Multi AV Scanner detection for submitted file

Source: Sldl84wxy8.exe	ReversingLabs: Detection: 57%
Source: Sldl84wxy8.exe	Virustotal: Detection: 39%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\start.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Sldl84wxy8.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost (3).exe PID: 6728, type: MEMORYSTR

Source: Sldl84wxy8.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\LICENSE.electron.txt			Jump to behavior

Source:	Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\App3FAAL98\obj\Release\App3FAAL98.pdb source: svchost (3).exe, 00000002.00000000.1411851058.000002422F752000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: d3dcompiler_47.dll.6.dr
Source:	Binary string: `OTHER`TEMP`PACKED<%s return value>internal error: failed to write debug data to pdb streaminternal error: failed to add section contributioninternal warning: PDB Error string is "%S"internal error: failed to close debug infointernal error: failed to close PDBinternal error: failed to open PDB for writing in streaminternal error: failed to create debug info in PDBinternal error: failed to add code section to debug infointernal error: failed to add module to debug infointernal error: failed to create type info in PDBinternal error: failed to create inline type info in PDBinternal error: failed to create source file store in PDBinternal error: failed to close source file store in PDBinternal error: failed to close module in debug infointernal error: failed to commit type info in PDBinternal error: failed to commit inline type info in PDBinternal error: failed to add section header to debug infointernal error: failed to append section header to pdbinternal error: failed to close section header in debug infointernal error: failed to close debug info in PDBinternal error: failed to commit PDBinternal error: PDB data too largeinternal error: PDB stream truncatedinternal error: failed to close source file storeinternal error: failed to close type infointernal error: pdb append failedfxl_4_0too many arguments to target TXtoo many outputs to target TXclip not supported in texture shadersinvalid reference to input semantic '%s%d'invalid reference to output semantic '%s%d'0123456789abcdef.pdbVPosSV_ViewportArrayIndexColorFailed to log error, redirecting to debug output: source: d3dcompiler_47.dll.6.dr
Source:	Binary string: D3DCompiler_47.pdbGCTL source: d3dcompiler_47.dll.6.dr

Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\resources

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2850454 ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT) 94.156.66.112:4449 -> 192.168.2.8:49711
Source: Traffic	Snort IDS: 2848152 ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant) 94.156.66.112:4449 -> 192.168.2.8:49711
Source: Traffic	Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 185.196.11.223:1339 -> 192.168.2.8:49716
Source: Traffic	Snort IDS: 2030673 ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) 185.196.11.223:1339 -> 192.168.2.8:49716

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: leetboy.dynuddns.net

Uses dynamic DNS services

Source: unknown

DNS query: name: leetboy.dynuddns.net

Yara detected Generic Downloader

Source: Yara match	File source: 10.0.start.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.start.exe.2589e10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\start.exe, type: DROPPED

Source: global traffic	TCP traffic: 192.168.2.8:49711 -> 94.156.66.112:4449
Source: global traffic	TCP traffic: 192.168.2.8:49716 -> 185.196.11.223:1339

Source: Joe Sandbox View	ASN Name: TERASYST-ASBG TERASYST-ASBG
Source: Joe Sandbox View	ASN Name: SIMPLECARRIERCH SIMPLECARRIERCH

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: blue.o7lab.me

Source: build.exe, 00000006.00000000.1434954851.000000000040A000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: start.exe, 0000000A.00000002.1498443006.000000000257E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: icudtl.dat0.6.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://alekberg.net/privacy
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://alekberg.net/privacyalekberg.net
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://chrome-devtools-frontend.appspot.com/
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: et.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u
Source: et.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=etOtsetee
Source: hi.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=hi
Source: hi.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=hi&category=theme81https://myactivity.google.com/myactivity/?u
Source: hr.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=hr&category=theme81https://myactivity.google.com/myactivity/?u
Source: hr.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=hrPre
Source: ml.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ml
Source: ml.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ml&category=theme81https://myactivity.google.com/myactivity/?u
Source: te.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=te
Source: te.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=te&category=theme81https://myactivity.google.com/myactivity/?u
Source: th.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=th
Source: th.pak.6.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=th&category=theme81https://myactivity.google.com/myactivity/?u
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://chromium.dns.nextdns.io
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://cleanbrowsing.org/privacy
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://cleanbrowsing.org/privacyCleanBrowsing
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://developers.google.com/speed/public-dns/privacy
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://developers.google.com/speed/public-dns/privacyGoogle
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns.google/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns.quad9.net/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns.sb/privacy/
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns10.quad9.net/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns11.quad9.net/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11Pd
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns64.dns.google/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dnsnl.alekberg.net/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh-01.spectrum.com/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh-02.spectrum.com/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh.cox.net/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh.cox.net/dns-querydot.cox.net68.105.28.1168.105.28.122001:578:3f::30
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh.dns.sb/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh.familyshield.opendns.com/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh.opendns.com/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh.quickline.ch/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://doh.xfinity.com/dns-query
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://myactivity.google.com/
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://nextdns.io/privacy
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://odvr.nic.cz/doh
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://odvr.nic.cz/dohodvr.nic.cz185.43.135.1193.17.47.12001:148f:fffe::12001:148f:ffff::1
Source: th.pak.6.dr	String found in binary or memory: https://passwords.google.com
Source: et.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://passwords.google.comGoogle
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).No
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://policies.google.com/
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://public.dns.iij.jp/
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://public.dns.iij.jp/IIJ
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://public.dns.iij.jp/dns-query
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://support.google.com/chrome/a/?p=block_warn
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: th.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: et.pak.6.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlHaldab
Source: hr.pak.6.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlPod
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.nic.cz/odvr/
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.nic.cz/odvr/CZ.NIC
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.quad9.net/home/privacy/
Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.quad9.net/home/privacy/Quad9

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 10.0.start.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.start.exe.2589e10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.start.exe.2589e10.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: start.exe PID: 5652, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\start.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchos.exe, type: DROPPED

Yara detected VenomRAT

Source: Yara match	File source: 2.2.svchost (3).exe.242314dec30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314ee870.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314ee870.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost (3).exe PID: 6728, type: MEMORYSTR

Contains functionality to log keystrokes (.Net Source)

Source: start.exe.1.dr, LimeLogger.cs	.Net Code: KeyboardLayout
Source: svchos.exe.10.dr, LimeLogger.cs	.Net Code: KeyboardLayout
Source: 10.2.start.exe.2589e10.0.raw.unpack, LimeLogger.cs	.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.svchost (3).exe.242314dec30.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 2.2.svchost (3).exe.242314ee870.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 10.0.start.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 10.0.start.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 10.2.start.exe.2589e10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 10.2.start.exe.2589e10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 10.2.start.exe.2589e10.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 10.2.start.exe.2589e10.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 2.2.svchost (3).exe.242314ee870.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0000000A.00000002.1498443006.0000000002451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000000A.00000002.1498443006.0000000002451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000012.00000002.1617321490.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000000A.00000002.1497624420.0000000000866000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000012.00000002.1605842437.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: start.exe PID: 5652, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: start.exe PID: 5652, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: svchos.exe PID: 6536, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\start.exe, type: DROPPED	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\start.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\build.exe	File dump: main.exe.6.dr 162036224			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File dump: main.exe0.6.dr 162036224			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B13E3E1	2_2_00007FFB4B13E3E1
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B1402C0	2_2_00007FFB4B1402C0
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B13DF59	2_2_00007FFB4B13DF59
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B140F69	2_2_00007FFB4B140F69
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B13B630	2_2_00007FFB4B13B630

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\ffmpeg.dll F11576BF7FFBC3669D1A5364378F35A1ED0811B7831528B6C4C55B0CDC7DC014

Source: C:\Users\user\AppData\Local\Temp\build.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6728 -s 1172

Source: main.exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: main.exe0.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: ffmpeg.dll0.6.dr	Static PE information: Number of sections : 11 > 10
Source: libEGL.dll.6.dr	Static PE information: Number of sections : 12 > 10
Source: main.exe.6.dr	Static PE information: Number of sections : 16 > 10
Source: vulkan-1.dll.6.dr	Static PE information: Number of sections : 12 > 10
Source: vk_swiftshader.dll.6.dr	Static PE information: Number of sections : 12 > 10
Source: vk_swiftshader.dll0.6.dr	Static PE information: Number of sections : 12 > 10
Source: libGLESv2.dll.6.dr	Static PE information: Number of sections : 12 > 10
Source: libGLESv2.dll0.6.dr	Static PE information: Number of sections : 12 > 10
Source: main.exe0.6.dr	Static PE information: Number of sections : 16 > 10
Source: ffmpeg.dll.6.dr	Static PE information: Number of sections : 11 > 10
Source: libEGL.dll0.6.dr	Static PE information: Number of sections : 12 > 10

Source: svchost (3).exe.1.dr

Static PE information: No import functions for PE file found

Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\start.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\svchos.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: windows.ui.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Section loaded: kbdus.dll

Source: Sldl84wxy8.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.svchost (3).exe.242314dec30.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 2.2.svchost (3).exe.242314ee870.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 10.0.start.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 10.0.start.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 10.2.start.exe.2589e10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 10.2.start.exe.2589e10.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 10.2.start.exe.2589e10.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 10.2.start.exe.2589e10.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 2.2.svchost (3).exe.242314ee870.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0000000A.00000002.1498443006.0000000002451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000000A.00000002.1498443006.0000000002451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000012.00000002.1617321490.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000000A.00000002.1497624420.0000000000866000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000012.00000002.1605842437.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: start.exe PID: 5652, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: start.exe PID: 5652, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: svchos.exe PID: 6536, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\start.exe, type: DROPPED	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\start.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: svchost (3).exe.1.dr, -.cs

Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: start.exe.1.dr, Settings.cs	Base64 encoded string: 'lBEW3RL3+jC7Y11fUmp229gPLDajXXwBna2G0XdxWmPaTNJ+wHxPHL4OLN3cL9gLPnD7tREj0IJYIGcPZg2Shw==', 'XthVhjEtlSYvTsMZQUgqztHFapykAIgUgUue102gtp4XFA3BPLaa3mgUoIr415m95px9jJpeRVpG5+ktCbRqgFTGwyZpUEmZLtiNAUxKSu4=', 'VJ5+m/RSOw2NXS5Yl0e1a7Hv21Ta5WkuE1euKHWcmw0N8151szE+hS+BNq7itkjUaJ7MR4/T7WaLFNrqeTUuKJROepkpb2aVM2wBDVbENFw=', 'N0xsrHU+PUP7j3kba/dXrZyKa3niCxiLj4vIHm9vEVjJJe9fwLgfTF0CB270i7kDFfENjmuaEwfk08tLoH4/vw==', 'sKV4qQSBUsaQMVjiGgAoozqOBwX75CNuskQUqLNmnM22n8vmIJ6nmTaZvY24mLlFfZc0D+lyDYH2Ho9P7U1+/GqD2esQRBqjSwUhroozsY8=', 'Jbamd/wBQkzxiJ8JZLbJpxlBkxbjcTRzFvvGaLNAtvBVksBrlMQfaWdYQjRiHAzZ8O7GvJJ76VAoXEBDq3CJV44Y3SHt4N8Jfe1oF9QfPusy0F+VwafyCTbwJfkECf2Jh9S2n7uWYPVMvQ7KzBoqbp2fW1SetT7IUu4J0J/KK+vliTpATvFrYbfVCRa9n/JDrcpv0mLG49GgtIGKTh8tKl8yZbhS5cQ5wQ+lx6NHclPkyP8Ilq3McxR7t88Q7by5skJ34GGnCgPMjQloibM3+7fm44QtxjTO088njXf5z4AzrUCyNUcnyKfm3PjoePtOcQoaBP2qCuDAKoOEg9E2qB4fyiBlDkpzBTe1iJ+d1fkhV14EtaRN4RVBtknoOYH0wJdOSpOYjgyGBFw2USlZ6X7q14WKjE9eXEeRveK1XdtuwKEiL5UkRrTkXsj0cdapCqbZ2zPwfbQ3xqHSk12R13uCosWhs7Rnn/W68cJplN9ORZ6Po8CtHmiytqsRrUj/YywaGAdGBCA0Jfqmg2pWIwdbV8nBgRePg3UAZc8e4/gutrTunWbp2tRdFxbUCLyHfaVV7++7uOGjbutwuQWidFSIzDzPBI4CmTph/Jaq1X4RamXuuAW7sGy1iWACwyVjG1UYYR4gPLwUBgcYfNAnbaxHrVfVeleE9h7lEeB4ypMQ8suf8Zd9IEqW/ei0v2baLgi4bp6GTUt1y9sZsigmV1NS1oKjoCGccTwEOTn7h0KutO7Qpw5IaYHBWe+tO7r/WpA7wfrDV3BhNTqAALqt65VMrKf4406JkZlltV/gdONbiBu7YSghVwCvAaf1GBXzODMgMrdn1fSz5H9NBbjSn3z59KVEAf7AKRSXCFaOEPsYVjVmRNsfjTbF5r4nYZJXdSB+OhrStR2qlwhnZNwK5YjduMPmygUwcBSm5HLW7GSUsppELfUoJdNkr01A8lcNzHt4McjS3AE9eBkEVHeuUg=='
Source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, Settings.cs	Base64 encoded string: 'VKknqP2uQzIaH21FCGVT22qaq4aykyWqrWmfPPRowcIoKM0VBcK0ElEggzsiV4WZbe8GPoiu2v55WByoWguhaw==', 'OlD/Av25kQgaR0LowKra910vmBCOykjmKOrRWqcwEFBCzpHZIQ1WVz4sPYbW6bjjmRDvJWPKIu4KcLNlS/WSMw==', 'SM2jUAZc85tLJuT7EZAsiJrhD1HmZ7MYFcRcPqX65o4ir8vBq2hDGCDkCDZkEqEmSiTg2MwjoHEht8jimP6j1kbvPmIsWd6TJBN+YE9SCyR3acALwLEqo147FqJR+8j1', 'JlRBim19qDl/Q0aZZ+CObUabIIAU5WdKxaFJIvwRZBWUV5CBMLqw+T34MFz8Jm6Glsw3BaakHOK1NkVvtF5lalfO0HfXDHcCsdmEyC7xaz6vO6FC+sCGBqs6G6yeqahDeFeJagX7rPF+Td6aAUmmiA0Cvksb8p1/3vEGoRverOtamg/5cdaz1xDqqIQPkxHNFsAfC3gOE3P3jHVwNg00ljS79moJTKEdS88cgGM6UKMkOFT0Ywrutwkxffd5BUqdjo7EUSJhoAmfxR//JZdqX+WhYlv7sWn3+dcMI6wHeqeBpwSuDpnBWrIZ3vjYYJZKT6ls3JHsiPelePB/LCWF8SoWpbDXmNZ3a0PPAvmGf0Jy3Tc+jsOTWMuggXoe+YtAoxcYeYzwwzjV162svGOVmuklO9Jhhr/xYi8RT8nV7RREaH8KquSefOvi+IpCj9s4T6j4AROBjXD/BMTNv6Cvac5vSdUBtXXIqmVw9qHoQtAlncnBKV9jlSR9zxknFZV2wpWykh9S4sFyWhYS7F7QzO2JTQxdhYF8frOWZZ7KJjWG+xmu7z6tdqQK7RpG0jwU058sE9M7Yep0U7KCsQ+/n46mvg87oWJQZBHZJBQuXtMJfGwO1YBPrF42xRsRAP3ayZnswpS8ZFZuWG9KxdZCJdYvHZlvqxDhxz6tOFAHq0OwGS/7FMR+7OcUHsLWPE2DGsO3bic3p6rwsHeOgxmPvMN2zwPwsCq10tkC5/KNTIVF5dimKSYe1r/hgIu2nf5HbJXgpMSzM+oLPVoYNvL9GsbPxtGCX4SU5Kxz2NYh9DYW/SVT45cuUzSPvkrzaRyWEcmqDxa0HYuyxJbkx7xB/HjX+yoGMiDTCDWD1KW+s6kVgXBRCf5001ePSzwE8R7KXUeE9VjqPRJF3Sfhx2N5iwd+opKsaVNT5hmgVDrJQ6ttgEgjYWaOCeL5DDqSDbY5j0RKLKnvGTBsJeiVG1Z4wAKrrn0UItgAIWsEQLAPcFCto+qM3V2e8fo4CjLXhMeJ2NiKnQ5U6cuXfhtCXNNJRpthHgN++nnBq4piyCZgIVMghHx41hP7EmZkLOth1D57', 'rJPxL9vFkgvrk7uGjmsZnwsb3uy8wQZ3W0bi9pseNOuyD5H7w41BaTGBDhoyt0UjVxaOeKIcf3c2ET98uLueNutxuwRF4DVuPHlUx3vAE/qvE69De+gUO6jNl7p5U/jtptYi3cgkenSyC0bfhix2MJfti3CCkViQDFbFHzbygcry7qagvHj+6wyv5ddIMQceBloyGCeit9skMad5A43xyDcnkilTBWXScYJBu7ix8ATzCrleWCcB/laQcAAIYrrzwOLD/SS/zD7q5nKjYd9zNo/LgIe+w5YH2zAKLUYC7Gc=', 'I45wSdXk1ODcSDzAfQhQ8aLF6LOGzi7up5xl1/1+tYwHa8Myr3cj/dTtAgmLIstDy9ktUeMgF7IJ7kLqfNoP8w==', 'kV73KGdlwoFqOWOcSRa1d/jO8D3Smg7SiDeemQxekzTSfio1vyjkvdVXEoC46pn8vu+HiUGZCEQVWA/R/Zc5ag==', '/S3RtOfinLqIYuA7pLVyRI6hCkZE2bISPtlJBWTzYEGDtcW6iNXZ3+aKL6jJUf5sJ2yxwdNNb6uNo/E4iVQ86w=='
Source: 2.2.svchost (3).exe.242314ee870.0.raw.unpack, Settings.cs	Base64 encoded string: 'VKknqP2uQzIaH21FCGVT22qaq4aykyWqrWmfPPRowcIoKM0VBcK0ElEggzsiV4WZbe8GPoiu2v55WByoWguhaw==', 'OlD/Av25kQgaR0LowKra910vmBCOykjmKOrRWqcwEFBCzpHZIQ1WVz4sPYbW6bjjmRDvJWPKIu4KcLNlS/WSMw==', 'SM2jUAZc85tLJuT7EZAsiJrhD1HmZ7MYFcRcPqX65o4ir8vBq2hDGCDkCDZkEqEmSiTg2MwjoHEht8jimP6j1kbvPmIsWd6TJBN+YE9SCyR3acALwLEqo147FqJR+8j1', 'JlRBim19qDl/Q0aZZ+CObUabIIAU5WdKxaFJIvwRZBWUV5CBMLqw+T34MFz8Jm6Glsw3BaakHOK1NkVvtF5lalfO0HfXDHcCsdmEyC7xaz6vO6FC+sCGBqs6G6yeqahDeFeJagX7rPF+Td6aAUmmiA0Cvksb8p1/3vEGoRverOtamg/5cdaz1xDqqIQPkxHNFsAfC3gOE3P3jHVwNg00ljS79moJTKEdS88cgGM6UKMkOFT0Ywrutwkxffd5BUqdjo7EUSJhoAmfxR//JZdqX+WhYlv7sWn3+dcMI6wHeqeBpwSuDpnBWrIZ3vjYYJZKT6ls3JHsiPelePB/LCWF8SoWpbDXmNZ3a0PPAvmGf0Jy3Tc+jsOTWMuggXoe+YtAoxcYeYzwwzjV162svGOVmuklO9Jhhr/xYi8RT8nV7RREaH8KquSefOvi+IpCj9s4T6j4AROBjXD/BMTNv6Cvac5vSdUBtXXIqmVw9qHoQtAlncnBKV9jlSR9zxknFZV2wpWykh9S4sFyWhYS7F7QzO2JTQxdhYF8frOWZZ7KJjWG+xmu7z6tdqQK7RpG0jwU058sE9M7Yep0U7KCsQ+/n46mvg87oWJQZBHZJBQuXtMJfGwO1YBPrF42xRsRAP3ayZnswpS8ZFZuWG9KxdZCJdYvHZlvqxDhxz6tOFAHq0OwGS/7FMR+7OcUHsLWPE2DGsO3bic3p6rwsHeOgxmPvMN2zwPwsCq10tkC5/KNTIVF5dimKSYe1r/hgIu2nf5HbJXgpMSzM+oLPVoYNvL9GsbPxtGCX4SU5Kxz2NYh9DYW/SVT45cuUzSPvkrzaRyWEcmqDxa0HYuyxJbkx7xB/HjX+yoGMiDTCDWD1KW+s6kVgXBRCf5001ePSzwE8R7KXUeE9VjqPRJF3Sfhx2N5iwd+opKsaVNT5hmgVDrJQ6ttgEgjYWaOCeL5DDqSDbY5j0RKLKnvGTBsJeiVG1Z4wAKrrn0UItgAIWsEQLAPcFCto+qM3V2e8fo4CjLXhMeJ2NiKnQ5U6cuXfhtCXNNJRpthHgN++nnBq4piyCZgIVMghHx41hP7EmZkLOth1D57', 'rJPxL9vFkgvrk7uGjmsZnwsb3uy8wQZ3W0bi9pseNOuyD5H7w41BaTGBDhoyt0UjVxaOeKIcf3c2ET98uLueNutxuwRF4DVuPHlUx3vAE/qvE69De+gUO6jNl7p5U/jtptYi3cgkenSyC0bfhix2MJfti3CCkViQDFbFHzbygcry7qagvHj+6wyv5ddIMQceBloyGCeit9skMad5A43xyDcnkilTBWXScYJBu7ix8ATzCrleWCcB/laQcAAIYrrzwOLD/SS/zD7q5nKjYd9zNo/LgIe+w5YH2zAKLUYC7Gc=', 'I45wSdXk1ODcSDzAfQhQ8aLF6LOGzi7up5xl1/1+tYwHa8Myr3cj/dTtAgmLIstDy9ktUeMgF7IJ7kLqfNoP8w==', 'kV73KGdlwoFqOWOcSRa1d/jO8D3Smg7SiDeemQxekzTSfio1vyjkvdVXEoC46pn8vu+HiUGZCEQVWA/R/Zc5ag==', '/S3RtOfinLqIYuA7pLVyRI6hCkZE2bISPtlJBWTzYEGDtcW6iNXZ3+aKL6jJUf5sJ2yxwdNNb6uNo/E4iVQ86w=='
Source: svchos.exe.10.dr, Settings.cs	Base64 encoded string: 'lBEW3RL3+jC7Y11fUmp229gPLDajXXwBna2G0XdxWmPaTNJ+wHxPHL4OLN3cL9gLPnD7tREj0IJYIGcPZg2Shw==', 'XthVhjEtlSYvTsMZQUgqztHFapykAIgUgUue102gtp4XFA3BPLaa3mgUoIr415m95px9jJpeRVpG5+ktCbRqgFTGwyZpUEmZLtiNAUxKSu4=', 'VJ5+m/RSOw2NXS5Yl0e1a7Hv21Ta5WkuE1euKHWcmw0N8151szE+hS+BNq7itkjUaJ7MR4/T7WaLFNrqeTUuKJROepkpb2aVM2wBDVbENFw=', 'N0xsrHU+PUP7j3kba/dXrZyKa3niCxiLj4vIHm9vEVjJJe9fwLgfTF0CB270i7kDFfENjmuaEwfk08tLoH4/vw==', 'sKV4qQSBUsaQMVjiGgAoozqOBwX75CNuskQUqLNmnM22n8vmIJ6nmTaZvY24mLlFfZc0D+lyDYH2Ho9P7U1+/GqD2esQRBqjSwUhroozsY8=', 'Jbamd/wBQkzxiJ8JZLbJpxlBkxbjcTRzFvvGaLNAtvBVksBrlMQfaWdYQjRiHAzZ8O7GvJJ76VAoXEBDq3CJV44Y3SHt4N8Jfe1oF9QfPusy0F+VwafyCTbwJfkECf2Jh9S2n7uWYPVMvQ7KzBoqbp2fW1SetT7IUu4J0J/KK+vliTpATvFrYbfVCRa9n/JDrcpv0mLG49GgtIGKTh8tKl8yZbhS5cQ5wQ+lx6NHclPkyP8Ilq3McxR7t88Q7by5skJ34GGnCgPMjQloibM3+7fm44QtxjTO088njXf5z4AzrUCyNUcnyKfm3PjoePtOcQoaBP2qCuDAKoOEg9E2qB4fyiBlDkpzBTe1iJ+d1fkhV14EtaRN4RVBtknoOYH0wJdOSpOYjgyGBFw2USlZ6X7q14WKjE9eXEeRveK1XdtuwKEiL5UkRrTkXsj0cdapCqbZ2zPwfbQ3xqHSk12R13uCosWhs7Rnn/W68cJplN9ORZ6Po8CtHmiytqsRrUj/YywaGAdGBCA0Jfqmg2pWIwdbV8nBgRePg3UAZc8e4/gutrTunWbp2tRdFxbUCLyHfaVV7++7uOGjbutwuQWidFSIzDzPBI4CmTph/Jaq1X4RamXuuAW7sGy1iWACwyVjG1UYYR4gPLwUBgcYfNAnbaxHrVfVeleE9h7lEeB4ypMQ8suf8Zd9IEqW/ei0v2baLgi4bp6GTUt1y9sZsigmV1NS1oKjoCGccTwEOTn7h0KutO7Qpw5IaYHBWe+tO7r/WpA7wfrDV3BhNTqAALqt65VMrKf4406JkZlltV/gdONbiBu7YSghVwCvAaf1GBXzODMgMrdn1fSz5H9NBbjSn3z59KVEAf7AKRSXCFaOEPsYVjVmRNsfjTbF5r4nYZJXdSB+OhrStR2qlwhnZNwK5YjduMPmygUwcBSm5HLW7GSUsppELfUoJdNkr01A8lcNzHt4McjS3AE9eBkEVHeuUg=='
Source: 10.2.start.exe.2589e10.0.raw.unpack, Settings.cs	Base64 encoded string: 'lBEW3RL3+jC7Y11fUmp229gPLDajXXwBna2G0XdxWmPaTNJ+wHxPHL4OLN3cL9gLPnD7tREj0IJYIGcPZg2Shw==', 'XthVhjEtlSYvTsMZQUgqztHFapykAIgUgUue102gtp4XFA3BPLaa3mgUoIr415m95px9jJpeRVpG5+ktCbRqgFTGwyZpUEmZLtiNAUxKSu4=', 'VJ5+m/RSOw2NXS5Yl0e1a7Hv21Ta5WkuE1euKHWcmw0N8151szE+hS+BNq7itkjUaJ7MR4/T7WaLFNrqeTUuKJROepkpb2aVM2wBDVbENFw=', 'N0xsrHU+PUP7j3kba/dXrZyKa3niCxiLj4vIHm9vEVjJJe9fwLgfTF0CB270i7kDFfENjmuaEwfk08tLoH4/vw==', 'sKV4qQSBUsaQMVjiGgAoozqOBwX75CNuskQUqLNmnM22n8vmIJ6nmTaZvY24mLlFfZc0D+lyDYH2Ho9P7U1+/GqD2esQRBqjSwUhroozsY8=', 'Jbamd/wBQkzxiJ8JZLbJpxlBkxbjcTRzFvvGaLNAtvBVksBrlMQfaWdYQjRiHAzZ8O7GvJJ76VAoXEBDq3CJV44Y3SHt4N8Jfe1oF9QfPusy0F+VwafyCTbwJfkECf2Jh9S2n7uWYPVMvQ7KzBoqbp2fW1SetT7IUu4J0J/KK+vliTpATvFrYbfVCRa9n/JDrcpv0mLG49GgtIGKTh8tKl8yZbhS5cQ5wQ+lx6NHclPkyP8Ilq3McxR7t88Q7by5skJ34GGnCgPMjQloibM3+7fm44QtxjTO088njXf5z4AzrUCyNUcnyKfm3PjoePtOcQoaBP2qCuDAKoOEg9E2qB4fyiBlDkpzBTe1iJ+d1fkhV14EtaRN4RVBtknoOYH0wJdOSpOYjgyGBFw2USlZ6X7q14WKjE9eXEeRveK1XdtuwKEiL5UkRrTkXsj0cdapCqbZ2zPwfbQ3xqHSk12R13uCosWhs7Rnn/W68cJplN9ORZ6Po8CtHmiytqsRrUj/YywaGAdGBCA0Jfqmg2pWIwdbV8nBgRePg3UAZc8e4/gutrTunWbp2tRdFxbUCLyHfaVV7++7uOGjbutwuQWidFSIzDzPBI4CmTph/Jaq1X4RamXuuAW7sGy1iWACwyVjG1UYYR4gPLwUBgcYfNAnbaxHrVfVeleE9h7lEeB4ypMQ8suf8Zd9IEqW/ei0v2baLgi4bp6GTUt1y9sZsigmV1NS1oKjoCGccTwEOTn7h0KutO7Qpw5IaYHBWe+tO7r/WpA7wfrDV3BhNTqAALqt65VMrKf4406JkZlltV/gdONbiBu7YSghVwCvAaf1GBXzODMgMrdn1fSz5H9NBbjSn3z59KVEAf7AKRSXCFaOEPsYVjVmRNsfjTbF5r4nYZJXdSB+OhrStR2qlwhnZNwK5YjduMPmygUwcBSm5HLW7GSUsppELfUoJdNkr01A8lcNzHt4McjS3AE9eBkEVHeuUg=='

Source: 2.2.svchost (3).exe.242314ee870.0.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.2.svchost (3).exe.242314ee870.0.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: svchos.exe.10.dr, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: svchos.exe.10.dr, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: start.exe.1.dr, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: start.exe.1.dr, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.start.exe.2589e10.0.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.2.start.exe.2589e10.0.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@32/108@6/5

Source: C:\Users\user\AppData\Local\Temp\start.exe

File created: C:\Users\user\AppData\Roaming\svchos.exe

Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\svchos.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4260:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4920:120:WilError_03

Source: C:\Users\user\Desktop\Sldl84wxy8.exe

File created: C:\Users\user\AppData\Local\Temp\svchost (3).exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\start.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpC5CE.tmp.bat""

Source: Sldl84wxy8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Sldl84wxy8.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Sldl84wxy8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: Sldl84wxy8.exe	ReversingLabs: Detection: 57%
Source: Sldl84wxy8.exe	Virustotal: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\Sldl84wxy8.exe "C:\Users\user\Desktop\Sldl84wxy8.exe"
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost (3).exe "C:\Users\user\AppData\Local\Temp\svchost (3).exe"
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6728 -s 1172
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Process created: C:\Users\user\AppData\Local\Temp\start.exe "C:\Users\user\AppData\Local\Temp\start.exe"
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpC5CE.tmp.bat""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchos.exe C:\Users\user\AppData\Roaming\svchos.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\svchos.exe "C:\Users\user\AppData\Roaming\svchos.exe"
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe "C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe "C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\main" --mojo-platform-channel-handle=2140 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost (3).exe "C:\Users\user\AppData\Local\Temp\svchost (3).exe"	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Process created: C:\Users\user\AppData\Local\Temp\start.exe "C:\Users\user\AppData\Local\Temp\start.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpC5CE.tmp.bat""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\svchos.exe "C:\Users\user\AppData\Roaming\svchos.exe"
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe "C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe "C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\main" --mojo-platform-channel-handle=2140 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

Source: C:\Users\user\Desktop\Sldl84wxy8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Sldl84wxy8.exe

Static file information: File size 66234368 > 1048576

Source: Sldl84wxy8.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x3f29800

Source:	Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\App3FAAL98\obj\Release\App3FAAL98.pdb source: svchost (3).exe, 00000002.00000000.1411851058.000002422F752000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: d3dcompiler_47.dll.6.dr
Source:	Binary string: `OTHER`TEMP`PACKED<%s return value>internal error: failed to write debug data to pdb streaminternal error: failed to add section contributioninternal warning: PDB Error string is "%S"internal error: failed to close debug infointernal error: failed to close PDBinternal error: failed to open PDB for writing in streaminternal error: failed to create debug info in PDBinternal error: failed to add code section to debug infointernal error: failed to add module to debug infointernal error: failed to create type info in PDBinternal error: failed to create inline type info in PDBinternal error: failed to create source file store in PDBinternal error: failed to close source file store in PDBinternal error: failed to close module in debug infointernal error: failed to commit type info in PDBinternal error: failed to commit inline type info in PDBinternal error: failed to add section header to debug infointernal error: failed to append section header to pdbinternal error: failed to close section header in debug infointernal error: failed to close debug info in PDBinternal error: failed to commit PDBinternal error: PDB data too largeinternal error: PDB stream truncatedinternal error: failed to close source file storeinternal error: failed to close type infointernal error: pdb append failedfxl_4_0too many arguments to target TXtoo many outputs to target TXclip not supported in texture shadersinvalid reference to input semantic '%s%d'invalid reference to output semantic '%s%d'0123456789abcdef.pdbVPosSV_ViewportArrayIndexColorFailed to log error, redirecting to debug output: source: d3dcompiler_47.dll.6.dr
Source:	Binary string: D3DCompiler_47.pdbGCTL source: d3dcompiler_47.dll.6.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: start.exe.1.dr, Packet.cs	.Net Code: Plugins System.AppDomain.Load(byte[])
Source: svchos.exe.10.dr, Packet.cs	.Net Code: Plugins System.AppDomain.Load(byte[])
Source: 10.2.start.exe.2589e10.0.raw.unpack, Packet.cs	.Net Code: Plugins System.AppDomain.Load(byte[])

Source: svchost (3).exe.1.dr

Static PE information: 0xC7E7BF4F [Sat Apr 11 18:02:55 2076 UTC]

Source: main.exe.6.dr	Static PE information: section name: .00cfg
Source: main.exe.6.dr	Static PE information: section name: .gxfg
Source: main.exe.6.dr	Static PE information: section name: .retplne
Source: main.exe.6.dr	Static PE information: section name: .rodata
Source: main.exe.6.dr	Static PE information: section name: .voltbl
Source: main.exe.6.dr	Static PE information: section name: CPADinfo
Source: main.exe.6.dr	Static PE information: section name: LZMADEC
Source: main.exe.6.dr	Static PE information: section name: _RDATA
Source: main.exe.6.dr	Static PE information: section name: malloc_h
Source: vk_swiftshader.dll.6.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.6.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.6.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.6.dr	Static PE information: section name: .voltbl
Source: vk_swiftshader.dll.6.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll.6.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.6.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.6.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.6.dr	Static PE information: section name: .voltbl
Source: ffmpeg.dll.6.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.6.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.6.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.6.dr	Static PE information: section name: .retplne
Source: libEGL.dll.6.dr	Static PE information: section name: .voltbl
Source: libEGL.dll.6.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.6.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.6.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.6.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.6.dr	Static PE information: section name: .voltbl
Source: libGLESv2.dll.6.dr	Static PE information: section name: _RDATA
Source: main.exe0.6.dr	Static PE information: section name: .00cfg
Source: main.exe0.6.dr	Static PE information: section name: .gxfg
Source: main.exe0.6.dr	Static PE information: section name: .retplne
Source: main.exe0.6.dr	Static PE information: section name: .rodata
Source: main.exe0.6.dr	Static PE information: section name: .voltbl
Source: main.exe0.6.dr	Static PE information: section name: CPADinfo
Source: main.exe0.6.dr	Static PE information: section name: LZMADEC
Source: main.exe0.6.dr	Static PE information: section name: _RDATA
Source: main.exe0.6.dr	Static PE information: section name: malloc_h
Source: vk_swiftshader.dll0.6.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll0.6.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll0.6.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll0.6.dr	Static PE information: section name: .voltbl
Source: vk_swiftshader.dll0.6.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.6.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.6.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.6.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.6.dr	Static PE information: section name: .voltbl
Source: vulkan-1.dll.6.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll0.6.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll0.6.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.6.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.6.dr	Static PE information: section name: .voltbl
Source: ffmpeg.dll0.6.dr	Static PE information: section name: _RDATA
Source: libEGL.dll0.6.dr	Static PE information: section name: .00cfg
Source: libEGL.dll0.6.dr	Static PE information: section name: .gxfg
Source: libEGL.dll0.6.dr	Static PE information: section name: .retplne
Source: libEGL.dll0.6.dr	Static PE information: section name: .voltbl
Source: libEGL.dll0.6.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll0.6.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.6.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll0.6.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll0.6.dr	Static PE information: section name: .voltbl
Source: libGLESv2.dll0.6.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B13B7D0 push eax; retf	2_2_00007FFB4B13B849
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B134FA8 push eax; iretd	2_2_00007FFB4B134FFD
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B132FE0 push eax; iretd	2_2_00007FFB4B134FFD
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B13D078 pushad ; iretd	2_2_00007FFB4B13D079
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B13CEBA push eax; retf	2_2_00007FFB4B13CED9
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B13CDAC push eax; retn 0008h	2_2_00007FFB4B13CDE4
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B13CDEC push eax; retn 0008h	2_2_00007FFB4B13CDE4
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B13C56C push eax; retf 0008h	2_2_00007FFB4B13C5A4
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Code function: 2_2_00007FFB4B23026B push esp; retf 4810h	2_2_00007FFB4B230312

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\Updater.exe

Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	File created: C:\Users\user\AppData\Local\Temp\start.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\main.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\start.exe	File created: C:\Users\user\AppData\Roaming\svchos.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\Updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	File created: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	File created: C:\Users\user\AppData\Local\Temp\build.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\LICENSE.electron.txt			Jump to behavior

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 10.0.start.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.start.exe.2589e10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.start.exe.2589e10.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: start.exe PID: 5652, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\start.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchos.exe, type: DROPPED

Yara detected VenomRAT

Source: Yara match	File source: 2.2.svchost (3).exe.242314dec30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314ee870.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314ee870.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost (3).exe PID: 6728, type: MEMORYSTR

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"'

Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: svchost (3).exe PID: 6728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: start.exe PID: 5652, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 10.0.start.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.start.exe.2589e10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.start.exe.2589e10.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: start.exe PID: 5652, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\start.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchos.exe, type: DROPPED

Yara detected VenomRAT

Source: Yara match	File source: 2.2.svchost (3).exe.242314dec30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314ee870.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314ee870.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost (3).exe PID: 6728, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp, start.exe, 0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp, start.exe, 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Memory allocated: 2422FA80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Memory allocated: 24249430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\start.exe	Memory allocated: 2240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\start.exe	Memory allocated: 2450000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\start.exe	Memory allocated: 2280000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svchos.exe	Memory allocated: 1530000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svchos.exe	Memory allocated: 2F40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svchos.exe	Memory allocated: 2D80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svchos.exe	Memory allocated: 16C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svchos.exe	Memory allocated: 3160000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svchos.exe	Memory allocated: 1720000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\start.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\svchos.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\svchos.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 908	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8901	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchos.exe	Window / User API: threadDelayed 9664

Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\vk_swiftshader.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\start.exe TID: 3116	Thread sleep count: 50 > 30
Source: C:\Users\user\AppData\Local\Temp\start.exe TID: 3284	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\svchos.exe TID: 3364	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\svchos.exe TID: 1308	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Roaming\svchos.exe TID: 1308	Thread sleep time: -35971150943733603s >= -30000s
Source: C:\Users\user\AppData\Roaming\svchos.exe TID: 4940	Thread sleep count: 9664 > 30
Source: C:\Users\user\AppData\Roaming\svchos.exe TID: 4940	Thread sleep count: 162 > 30

Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\start.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\svchos.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\svchos.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\start.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\svchos.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\svchos.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	File opened: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\resources

Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: start.exe, 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: start.exe, 0000000A.00000002.1497624420.0000000000866000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}=
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: start.exe, 0000000A.00000002.1497624420.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 06e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_C
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II

Source: C:\Users\user\AppData\Local\Temp\start.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\start.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\svchos.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: svchost (3).exe.1.dr, ----.cs	Reference to suspicious API methods: _FD4F.GetProcAddress(: _FDEC_060C_FDDA_FD48_0617_061E._FDD6_FD45_FBB9_064E_FDEA_0654_06D7("\u0610\ufdd0").Replace(_FDEC_060C_FDDA_FD48_0617_061E._FDD6_FD45_FBB9_064E_FDEA_0654_06D7("\u0600\ufdfe\u06e0\ufd4f"), ""), _FDDE_FDE3_FDE8_060D_0652: _FD4F.LoadLibrary(text.Replace(_FDEC_060C_FDDA_FD48_0617_061E._FDD6_FD45_FBB9_064E_FDEA_0654_06D7(""), "")))
Source: svchost (3).exe.1.dr, ----.cs	Reference to suspicious API methods: _FD4F.GetProcAddress(: _FDEC_060C_FDDA_FD48_0617_061E._FDD6_FD45_FBB9_064E_FDEA_0654_06D7("\u0610\ufdd0").Replace(_FDEC_060C_FDDA_FD48_0617_061E._FDD6_FD45_FBB9_064E_FDEA_0654_06D7("\u0600\ufdfe\u06e0\ufd4f"), ""), _FDDE_FDE3_FDE8_060D_0652: _FD4F.LoadLibrary(text.Replace(_FDEC_060C_FDDA_FD48_0617_061E._FDD6_FD45_FBB9_064E_FDEA_0654_06D7(""), "")))
Source: svchost (3).exe.1.dr, -.cs	Reference to suspicious API methods: ((_066C_FBBC_060F_FDDE_06D9_060E)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibrary("kernel32.dll"), "VirtualProtect"), typeof(_066C_FBBC_060F_FDDE_06D9_060E)))(_FD47_0607_06EB, _FDCF_06DE_065E, _FBBB_FD49_FDE6_FBCB_FBBB_FDD4_061D_FDD5_0613_06D7_FBC1, out _FBB5_FD48_065B_0658_FDCD_FDDD)
Source: start.exe.1.dr, LimeLogger.cs	Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)
Source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, DInvokeCore.cs	Reference to suspicious API methods: DynamicAPIInvoke("ntdll.dll", "NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref Parameters)
Source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, AntiProcess.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe

Section unmapped: unknown base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 412000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 414000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7D4008	Jump to behavior

Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost (3).exe "C:\Users\user\AppData\Local\Temp\svchost (3).exe"	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Sldl84wxy8.exe	Process created: C:\Users\user\AppData\Local\Temp\start.exe "C:\Users\user\AppData\Local\Temp\start.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit
Source: C:\Users\user\AppData\Local\Temp\start.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpC5CE.tmp.bat""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\svchos.exe "C:\Users\user\AppData\Roaming\svchos.exe"
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe "C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe "C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\main" --mojo-platform-channel-handle=2140 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe "c:\users\user\appdata\local\temp\2ehfvuyszqzzl8quac9nldhe9q6\main.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\main" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1628 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe "c:\users\user\appdata\local\temp\2ehfvuyszqzzl8quac9nldhe9q6\main.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\main" --mojo-platform-channel-handle=2140 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe "c:\users\user\appdata\local\temp\2ehfvuyszqzzl8quac9nldhe9q6\main.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\main" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1628 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Process created: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe "c:\users\user\appdata\local\temp\2ehfvuyszqzzl8quac9nldhe9q6\main.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\main" --mojo-platform-channel-handle=2140 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8

Source: main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp

Binary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Queries volume information: C:\Users\user\AppData\Local\Temp\svchost (3).exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\start.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\start.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\start.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\svchos.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchos.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\svchos.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchos.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\svchos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\svchos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\svchos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\svchos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\svchost (3).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 10.0.start.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.start.exe.2589e10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.start.exe.2589e10.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: start.exe PID: 5652, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\start.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchos.exe, type: DROPPED

Yara detected VenomRAT

Source: Yara match	File source: 2.2.svchost (3).exe.242314dec30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314ee870.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314ee870.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost (3).exe.242314dec30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost (3).exe PID: 6728, type: MEMORYSTR

Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: svchost (3).exe, 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\svchos.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	412 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	23 System Information Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	3 Scheduled Task/Job	3 Scheduled Task/Job	211 Obfuscated Files or Information	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	Login Hook	Login Hook	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	22 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 Scheduled Task/Job	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Sldl84wxy8.exe	58%	ReversingLabs	Win32.Dropper.Dapato
Sldl84wxy8.exe	40%	Virustotal		Browse
Sldl84wxy8.exe	100%	Avira	TR/Dropper.Gen
Sldl84wxy8.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\start.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\start.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\svchost (3).exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\d3dcompiler_47.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\ffmpeg.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libEGL.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libGLESv2.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\vk_swiftshader.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\build.exe	8%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\build.exe	15%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\d3dcompiler_47.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\ffmpeg.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\libEGL.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\libGLESv2.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\main.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\main.exe	1%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
rentry.co	2%	Virustotal	Browse
blue.o7lab.me	16%	Virustotal	Browse
leetboy.dynuddns.net	9%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://dns10.quad9.net/dns-query	0%	URL Reputation	safe
https://chromium.dns.nextdns.io	0%	URL Reputation	safe
https://doh.cleanbrowsing.org/doh/security-filter	0%	URL Reputation	safe
https://dns.google/dns-query	0%	URL Reputation	safe
https://public.dns.iij.jp/	0%	URL Reputation	safe
https://public.dns.iij.jp/	0%	URL Reputation	safe
https://dns11.quad9.net/dns-query	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled	0%	URL Reputation	safe
https://doh.cleanbrowsing.org/doh/family-filter	0%	URL Reputation	safe
https://cleanbrowsing.org/privacy	0%	URL Reputation	safe
https://www.quad9.net/home/privacy/	0%	URL Reputation	safe
https://dns64.dns.google/dns-query	0%	URL Reputation	safe
https://doh.cleanbrowsing.org/doh/adult-filter	0%	URL Reputation	safe
https://passwords.google.comGoogle	0%	URL Reputation	safe
https://dns.quad9.net/dns-query	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://public.dns.iij.jp/dns-query	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	0%	URL Reputation	safe
https://dns.sb/privacy/	0%	URL Reputation	safe
https://doh.dns.sb/dns-query	0%	URL Reputation	safe
https://alekberg.net/privacy	0%	URL Reputation	safe
https://dnsnl.alekberg.net/dns-query	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist	0%	URL Reputation	safe
https://www.quad9.net/home/privacy/Quad9	0%	Avira URL Cloud	safe
https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11Pd	0%	Avira URL Cloud	safe
https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn	0%	Avira URL Cloud	safe
https://perfetto.dev/docs/contributing/getting-started#community).No	0%	Avira URL Cloud	safe
https://chrome-devtools-frontend.appspot.com/	0%	Avira URL Cloud	safe
https://chrome-devtools-frontend.appspot.com/	0%	Virustotal		Browse
https://perfetto.dev/docs/contributing/getting-started#community).	0%	Avira URL Cloud	safe
https://public.dns.iij.jp/IIJ	0%	Avira URL Cloud	safe
https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10	0%	Avira URL Cloud	safe
https://cleanbrowsing.org/privacyCleanBrowsing	0%	Avira URL Cloud	safe
https://perfetto.dev/docs/contributing/getting-started#community).	0%	Virustotal		Browse
https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10	2%	Virustotal		Browse
https://nextdns.io/privacy	0%	Avira URL Cloud	safe
https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn	1%	Virustotal		Browse
https://alekberg.net/privacyalekberg.net	0%	Avira URL Cloud	safe
https://perfetto.dev/docs/contributing/getting-started#community).No	0%	Virustotal		Browse
https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0	0%	Avira URL Cloud	safe
https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::	0%	Avira URL Cloud	safe
https://nextdns.io/privacy	0%	Virustotal		Browse
https://alekberg.net/privacyalekberg.net	0%	Virustotal		Browse
https://www.quad9.net/home/privacy/Quad9	0%	Virustotal		Browse
https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query	0%	Avira URL Cloud	safe
https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11Pd	4%	Virustotal		Browse
https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC	0%	Avira URL Cloud	safe
leetboy.dynuddns.net	100%	Avira URL Cloud	phishing
https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0	0%	Virustotal		Browse
https://public.dns.iij.jp/IIJ	0%	Virustotal		Browse
https://cleanbrowsing.org/privacyCleanBrowsing	0%	Virustotal		Browse
https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC	0%	Virustotal		Browse
leetboy.dynuddns.net	9%	Virustotal		Browse
https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query	0%	Virustotal		Browse
https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rentry.co	104.21.95.148	true	false	2%, Virustotal, Browse	unknown
cosmicdust.zip	192.236.232.25	true	false		unknown
cosmoplanets.net	172.67.142.111	true	false		unknown
blue.o7lab.me	94.156.66.112	true	true	16%, Virustotal, Browse	unknown
leetboy.dynuddns.net	185.196.11.223	true	true	9%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	69.164.0.0	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
leetboy.dynuddns.net	true	9%, Virustotal, Browse Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://doh.cox.net/dns-querydot.cox.net68.105.28.1168.105.28.122001:578:3f::30	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://support.google.com/chrome/answer/6098869	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false		high
https://dns10.quad9.net/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/chrome/privacy/eula_text.html	th.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false		high
https://chromium.dns.nextdns.io	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
http://www.unicode.org/copyright.html	icudtl.dat0.6.dr	false		high
https://www.google.com/chrome/privacy/eula_text.htmlPod	hr.pak.6.dr	false		high
https://doh.familyshield.opendns.com/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://chrome.google.com/webstore?hl=hrPre	hr.pak.6.dr	false		high
https://doh.cleanbrowsing.org/doh/security-filter	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=ml	ml.pak.6.dr	false		high
https://dns.google/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlHaldab	et.pak.6.dr	false		high
https://public.dns.iij.jp/	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u	et.pak.6.dr	false		high
https://chrome.google.com/webstore?hl=te&category=theme81https://myactivity.google.com/myactivity/?u	te.pak.6.dr	false		high
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false		high
https://doh.cox.net/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://myactivity.google.com/	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false		high
https://perfetto.dev/docs/contributing/getting-started#community).No	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11Pd	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://doh.quickline.ch/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://www.nic.cz/odvr/	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://chrome-devtools-frontend.appspot.com/	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developers.google.com/speed/public-dns/privacy	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://dns11.quad9.net/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://chrome.google.com/webstore?hl=etOtsetee	et.pak.6.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false	URL Reputation: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false	URL Reputation: safe	unknown
https://passwords.google.com	th.pak.6.dr	false		high
https://www.nic.cz/odvr/CZ.NIC	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://policies.google.com/	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false		high
https://doh-02.spectrum.com/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://chrome.google.com/webstore?hl=th&category=theme81https://myactivity.google.com/myactivity/?u	th.pak.6.dr	false		high
https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.quad9.net/home/privacy/Quad9	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	start.exe, 0000000A.00000002.1498443006.000000000257E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://perfetto.dev/docs/contributing/getting-started#community).	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://public.dns.iij.jp/IIJ	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=te	te.pak.6.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false	URL Reputation: safe	unknown
https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cleanbrowsing.org/privacyCleanBrowsing	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nextdns.io/privacy	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://odvr.nic.cz/doh	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://chrome.google.com/webstore/category/extensions	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false		high
https://doh.cleanbrowsing.org/doh/family-filter	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chromebook?p=app_intent	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false		high
https://doh.xfinity.com/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://alekberg.net/privacyalekberg.net	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cleanbrowsing.org/privacy	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://www.quad9.net/home/privacy/	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=ml&category=theme81https://myactivity.google.com/myactivity/?u	ml.pak.6.dr	false		high
https://chrome.google.com/webstore?hl=th	th.pak.6.dr	false		high
https://developers.google.com/speed/public-dns/privacyGoogle	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dns64.dns.google/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://doh.cleanbrowsing.org/doh/adult-filter	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://doh.opendns.com/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://passwords.google.comGoogle	et.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false	URL Reputation: safe	unknown
https://doh-01.spectrum.com/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	build.exe, 00000006.00000000.1434954851.000000000040A000.00000008.00000001.01000000.0000000B.sdmp	false		high
https://dns.quad9.net/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=hi&category=theme81https://myactivity.google.com/myactivity/?u	hi.pak.6.dr	false		high
https://www.cisco.com/c/en/us/about/legal/privacy-full.html	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=hr&category=theme81https://myactivity.google.com/myactivity/?u	hr.pak.6.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false	URL Reputation: safe	unknown
https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://odvr.nic.cz/dohodvr.nic.cz185.43.135.1193.17.47.12001:148f:fffe::12001:148f:ffff::1	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false		high
https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://public.dns.iij.jp/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=hi	hi.pak.6.dr	false		high
https://dns.sb/privacy/	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://doh.dns.sb/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/a/?p=block_warn	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false		high
https://alekberg.net/privacy	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://dnsnl.alekberg.net/dns-query	main.exe, 00000017.00000000.1711768969.00007FF658C32000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist	et.pak.6.dr, th.pak.6.dr, hr.pak.6.dr, hi.pak.6.dr, ml.pak.6.dr, te.pak.6.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
94.156.66.112	blue.o7lab.me	Bulgaria	31420	TERASYST-ASBG	true
192.236.232.25	cosmicdust.zip	United States	54290	HOSTWINDSUS	false
172.67.142.111	cosmoplanets.net	United States	13335	CLOUDFLARENETUS	false
104.21.95.148	rentry.co	United States	13335	CLOUDFLARENETUS	false
185.196.11.223	leetboy.dynuddns.net	Switzerland	42624	SIMPLECARRIERCH	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417125
Start date and time:	2024-03-28 16:23:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Sldl84wxy8.exe renamed because original name is a hash value
Original Sample Name:	0b459466e3619d2a29bb93ea2dac077a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@32/108@6/5
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 81% Number of executed functions: 46 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 69.164.0.0, 20.42.65.92, 72.21.81.240
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, umwatson.events.data.microsoft.com
Execution Graph export aborted for target start.exe, PID 5652 because it is empty
Execution Graph export aborted for target svchos.exe, PID 6536 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:25:03	API Interceptor	1x Sleep call for process: RegSvcs.exe modified
16:25:04	API Interceptor	1x Sleep call for process: WerFault.exe modified
16:25:05	Task Scheduler	Run new task: svchos path: "C:\Users\user\AppData\Roaming\svchos.exe"
16:25:45	API Interceptor	8259672x Sleep call for process: svchos.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
94.156.66.112	V1yLpoS3XR.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse
94.156.66.112	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse
192.236.232.25	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse
192.236.232.25	Tank-RevolutionDEMO.exe	Get hash	malicious	Unknown	Browse
172.67.142.111	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse
104.21.95.148	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse
	troca.msi	Get hash	malicious	Unknown	Browse
	Leak Porn MMS Teen Girl.js	Get hash	malicious	RHADAMANTHYS	Browse
185.196.11.223	V1yLpoS3XR.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse
185.196.11.223	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
blue.o7lab.me	V1yLpoS3XR.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	94.156.66.112
blue.o7lab.me	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	94.156.66.112
windowsupdatebg.s.llnwi.net	6sg60cSBIQ.dll	Get hash	malicious	Unknown	Browse	69.164.0.128
	https://www.rewardgateway.com/	Get hash	malicious	HTMLPhisher	Browse	69.164.0.0
	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	69.164.0.128
	https://www.attemplate.com/gcc/24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0f42-45b3-8f82-5ddbf95d3c28/4526622a-5e47-4913-897d-b139c3f50e94/attachment?id=T3JlSlFGWnFzWFRVUk1mQzVwN1d5V3BvT0lIMGd1MmFSTncyMDRDRXRKY1dLWnk0bmZKanUwWkxaU0JRa1VvOGZhTkloMFNSY24vUTU3cFB2eGJmY090ZVc1ZUc0MHdldWRuVFdSWEtLem5UV3VXTlozS0kwTGpGTDNTT0d0SHAveERBQjJFUUNPTUhqWDY3MVJlZzhiSG14ZjVqMmdjNlVUMjh1NXpwazZLblFjeHdDQlBxblJwaVNKY1R6WUp6YnlhaHo5dTRpRFZUY2w2SGQwRW9oNzNXTFJ5MjdQN090UzNtWHIwZDVVK21OV095NHRLT0plZ29TT3EweVdZaDlhUW9lK2lmOWtpOUlmTFRYL3pDSVZzRCt2WEFBbjQyNVRQTDBoRE9IK1NXbmM3UndCdjk2dUg5QVF3MnRodGN3V2NjSCt1ZXZVbzR4VUt5dnEzcFhzOGRkRGUvYWROemJ4NDNHRkJLejRtU01ISmpOYVpEbi9GdUlJUFliMGQ1MHFBaHJCYnQzWWhMTExQcUtUU0RzQT09	Get hash	malicious	Unknown	Browse	69.164.0.128
	FindAll.xla	Get hash	malicious	Unknown	Browse	69.164.0.128
	SecuriteInfo.com.Trojan.Siggen27.33484.28759.31674.exe	Get hash	malicious	Unknown	Browse	69.164.0.0
	8tUCycu3Wq.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	69.164.0.0
	7294042_PDF.vbs	Get hash	malicious	GuLoader	Browse	69.164.0.0
	https://mail.profil.aktualisieren.87-121-52-217.cprapid.com/	Get hash	malicious	PayPal Phisher	Browse	69.164.0.128
	https://main.d3ugl75lhwl13s.amplifyapp.com/?serious-windows-defender-security-detection	Get hash	malicious	TechSupportScam	Browse	69.164.0.0
leetboy.dynuddns.net	V1yLpoS3XR.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	185.196.11.223
leetboy.dynuddns.net	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	185.196.11.223
rentry.co	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	104.21.95.148
	troca.msi	Get hash	malicious	Unknown	Browse	104.21.95.148
	Epdf_information.msi	Get hash	malicious	Unknown	Browse	172.67.145.129
	Tank-RevolutionDEMO.exe	Get hash	malicious	Unknown	Browse	172.67.145.129
	SecuriteInfo.com.Variant.Cerbu.203511.29180.28624.exe	Get hash	malicious	Unknown	Browse	172.67.145.129
	SecuriteInfo.com.Trojan.MulDrop24.59030.23050.13183.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	172.67.145.129
	SecuriteInfo.com.Variant.Cerbu.203511.29180.28624.exe	Get hash	malicious	Unknown	Browse	172.67.145.129
	SecuriteInfo.com.FileRepMalware.16037.9737.exe	Get hash	malicious	Python Stealer	Browse	172.67.145.129
	Leak Porn MMS Teen Girl.js	Get hash	malicious	RHADAMANTHYS	Browse	104.21.95.148
	SecuriteInfo.com.Trojan.GenericKD.70641791.20493.31768.exe	Get hash	malicious	Python Stealer, CStealer	Browse	51.83.3.90
cosmicdust.zip	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	192.236.232.25
cosmicdust.zip	Tank-RevolutionDEMO.exe	Get hash	malicious	Unknown	Browse	192.236.232.25
cosmoplanets.net	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	172.67.142.111
cosmoplanets.net	Tank-RevolutionDEMO.exe	Get hash	malicious	Unknown	Browse	191.101.104.58

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://www.rewardgateway.com	Get hash	malicious	HTMLPhisher	Browse	104.18.79.253
	https://www.rewardgateway.com/	Get hash	malicious	HTMLPhisher	Browse	104.18.79.253
	securedoc_20240328T081124.html	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://airispharma1-my.sharepoint.com/:o:/g/personal/anagaraj_airispharma_com/EvmEpKGsyxtGnlrgsjVRxi4BOj2g3uhzHgNY6tXqx6wp5g?e=JtdJfI	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://credit-bittrex.com/creditor	Get hash	malicious	Phisher	Browse	172.67.213.53
	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	104.21.95.148
	Quarantined Messages (12).zip	Get hash	malicious	Unknown	Browse	1.1.1.1
	Receipt_2821-Overdue-PO.msg	Get hash	malicious	Unknown	Browse	172.67.144.70
	https://gcv.microsoft.us/kgRWagmalJ	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.25.14
	BL-SHIPPING INVOICE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
CLOUDFLARENETUS	http://www.rewardgateway.com	Get hash	malicious	HTMLPhisher	Browse	104.18.79.253
	https://www.rewardgateway.com/	Get hash	malicious	HTMLPhisher	Browse	104.18.79.253
	securedoc_20240328T081124.html	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://airispharma1-my.sharepoint.com/:o:/g/personal/anagaraj_airispharma_com/EvmEpKGsyxtGnlrgsjVRxi4BOj2g3uhzHgNY6tXqx6wp5g?e=JtdJfI	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://credit-bittrex.com/creditor	Get hash	malicious	Phisher	Browse	172.67.213.53
	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	104.21.95.148
	Quarantined Messages (12).zip	Get hash	malicious	Unknown	Browse	1.1.1.1
	Receipt_2821-Overdue-PO.msg	Get hash	malicious	Unknown	Browse	172.67.144.70
	https://gcv.microsoft.us/kgRWagmalJ	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.25.14
	BL-SHIPPING INVOICE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
SIMPLECARRIERCH	V1yLpoS3XR.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	185.196.11.223
	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	185.196.11.223
	9NBx4Vmiuj.exe	Get hash	malicious	PureLog Stealer, XWorm, zgRAT	Browse	185.196.10.233
	UNca1snvkz.elf	Get hash	malicious	Mirai	Browse	185.196.10.155
	bd7kzboTUq.elf	Get hash	malicious	Mirai	Browse	185.196.10.155
	H6ZdQFux3W.elf	Get hash	malicious	Mirai	Browse	185.196.10.155
	jxJoK9xswU.elf	Get hash	malicious	Mirai	Browse	185.196.10.155
	29oAGfUZCW.elf	Get hash	malicious	Mirai	Browse	185.196.10.155
	pwybQt2eUG.elf	Get hash	malicious	Mirai	Browse	185.196.10.155
	5sIvHoFITx.elf	Get hash	malicious	Mirai	Browse	185.196.10.155
HOSTWINDSUS	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	192.236.232.25
	Q9Jn6b7bIj.elf	Get hash	malicious	Mirai	Browse	198.84.69.50
	thurs20.exe	Get hash	malicious	Python Stealer	Browse	192.236.232.35
	thurs17.exe	Get hash	malicious	Python Stealer	Browse	192.236.232.35
	thurs21.exe	Get hash	malicious	Python Stealer	Browse	192.236.232.35
	thurs19.exe	Get hash	malicious	Python Stealer	Browse	192.236.232.35
	thurs18.exe	Get hash	malicious	Python Stealer	Browse	192.236.232.35
	thurs14.exe	Get hash	malicious	Python Stealer	Browse	192.236.232.35
	thurs9.exe	Get hash	malicious	Python Stealer	Browse	192.236.232.35
	thurs13.exe	Get hash	malicious	Python Stealer	Browse	192.236.232.35
TERASYST-ASBG	V1yLpoS3XR.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	94.156.66.112
	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse	94.156.66.112
	LQ2sKCMmXw.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	94.156.69.232
	WFbZkwBBqG.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.71.205
	o7g23WWTSM.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.71.205
	drP2lFrTw8.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.71.205
	V0Ev61kN3E.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.71.205
	hxLoX40UD6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.71.205
	a5nJUdCd2B.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.71.205
	i9nAGl38hA.elf	Get hash	malicious	Mirai, Gafgyt	Browse	94.156.71.205

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\d3dcompiler_47.dll	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse
	Mauqes.exe	Get hash	malicious	Unknown	Browse
	Tank-RevolutionDEMO.exe	Get hash	malicious	Unknown	Browse
	Google Digital Marketing .xlsx.exe	Get hash	malicious	Unknown	Browse
	Google Digital Marketing .xlsx.exe	Get hash	malicious	Unknown	Browse
	systemtest-standalone-10.12.3.exe	Get hash	malicious	Unknown	Browse
	systemtest-standalone-10.12.3.exe	Get hash	malicious	Unknown	Browse
	TrelloSetup.exe	Get hash	malicious	Unknown	Browse
	TrelloSetup.exe	Get hash	malicious	Unknown	Browse
	W1nnerFree CS2.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\ffmpeg.dll	rU6YAgkoAw.exe	Get hash	malicious	AsyncRAT	Browse
	Tank-RevolutionDEMO.exe	Get hash	malicious	Unknown	Browse
	Google Digital Marketing .xlsx.exe	Get hash	malicious	Unknown	Browse
	Google Digital Marketing .xlsx.exe	Get hash	malicious	Unknown	Browse
	systemtest-standalone-10.12.3.exe	Get hash	malicious	Unknown	Browse
	systemtest-standalone-10.12.3.exe	Get hash	malicious	Unknown	Browse
	ForestOfDream.exe	Get hash	malicious	Unknown	Browse
	ForestOfDream.exe	Get hash	malicious	Unknown	Browse
	sims4c.exe	Get hash	malicious	Unknown	Browse
	RemasterSouls Setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost (3).exe_6122bbe2fa8fede73f613859bbd18b79843c243_1f2af782_88721aa2-c727-47e9-bfe6-32bf9bdb24f2\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1436285878782433
Encrypted:	false
SSDEEP:	192:p6wm+L0UnU1aWj3OlTwd7ZFEszuiF/Z24lO8v:Ab+YUnU1aYou9zuiF/Y4lO8v
MD5:	E4A86785AE8C1FDC930FE8DF7C8ABAA3
SHA1:	5A66C17ACC0F96A4F82E8F0DDAD0A653DBA4EA64
SHA-256:	BC7B8DDD70B4DA0544C08086037B88B6091328AFA8AB04A0D573B36973B37223
SHA-512:	32DDF8F5F1231EDADF4313F9C474188383F95AC5D71235427A4AD613ABFEE47E9FDBA15229F426E6CC61BC961A4667608B8997091BE90702E16F21CB243737F6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.1.1.3.0.9.8.6.6.6.4.3.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.6.1.1.3.0.9.9.7.4.4.5.6.0.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.8.7.2.1.a.a.2.-.c.7.2.7.-.4.7.e.9.-.b.f.e.6.-.3.2.b.f.9.b.d.b.2.4.f.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.8.3.7.5.b.3.-.f.5.c.4.-.4.0.6.5.-.a.3.a.c.-.1.1.2.1.6.d.e.3.d.7.f.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.s.v.c.h.o.s.t. .(.3.)...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.p.p.3.F.A.A.L.9.8...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.4.8.-.0.0.0.1.-.0.0.1.4.-.4.a.4.7.-.a.f.1.6.2.4.8.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.6.a.5.b.7.a.3.d.4.e.f.f.d.2.7.b.d.0.8.c.e.a.0.1.d.9.9.4.c.2.0.0.0.0.0.0.0.0.0.!.0.0.0.0.3.b.6.a.8.a.5.1.f.5.3.d.8.e.c.6.e.7.7.3.f.2.a.2.8.f.8.0.f.b.0.0.3.3.1.1.5.9.7.b.!.s.v.c.h.o.s.t.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF87.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Mar 28 15:24:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	512245
Entropy (8bit):	3.4009107209896174
Encrypted:	false
SSDEEP:	3072:CUK8W0FRgZG4FOao1CCqNq3+v1YbPvRP4WPj3gCCcSC9YvvE8lXQ:hK8W0Fl9qNq3QabxPXrgCaCQ
MD5:	0853D6437FF8D29A39EE17D2B0B69D0A
SHA1:	2B8D8F85226DE725CE30C082C8D4DDCB0EA98700
SHA-256:	0DDE654A12AEEF7E249699A04F5DE6CDE36CFEAA2D0AD651588B7947BF1CBF72
SHA-512:	51AB591EFBAD2397B4F5934E0C05A696EEA4068C2F2720C31C081A8237261315868BBE9D7A228BF2F7911B1137F0F75E607448C608132A87182C5DA31B03BEB0
Malicious:	false
Preview:	MDMP..a..... .........f............D...........8...d.......$.... ......."... .......X.............l.......8...........T............-...............C...........E..............................................................................eJ......(F......Lw......................T.......H.....f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB247.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6822
Entropy (8bit):	3.7414354083597208
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbm+ZVVbYBcMfTTXgaM4UKq89bvxA4t/fUVhm:R6l7wVeJm+ZVVbYWMIprx89bpA4fUjm
MD5:	506B3BFBB0ADDE716765EB469939D895
SHA1:	424C44799AE14F34175E3CF5E9F4053511751707
SHA-256:	8A98F21D08CB7F6DA46A0AABAD71C2EB6DAEB37018256DEF4459059BF2B33FE2
SHA-512:	E71963799919A797B36AC80022896A005EC9BC08213E2D70CDFE534B1124D1FA8FB93D52A9AA2B1681B457A9F9EE094A78D02E9E5220FCDD4EF9AF6807085CBA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB267.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4768
Entropy (8bit):	4.509114197393359
Encrypted:	false
SSDEEP:	48:cvIwWl8zs7Jg771I9vMWpW8VYEYm8M4JCPQFHAfIyq85xePwSwBTlSsd:uIjfVI7Ul7V4JCZARwvxAsd
MD5:	FB8C73D4E9653C791336B88BE8FA1E27
SHA1:	252DA2B29381DF5B95BBF3CB9F81F188BA24BD93
SHA-256:	AD5318E36A79702E7741D4317050A77CDF181146107754B68075C3D476B4FD61
SHA-512:	E9983C9FA856FE1A93EBD7BA65FE9C9491DCB31E71D1DDE4841D5383D12CE5588C57EF75DEF2BCD2F14F490936096A7A1948511F907C68EE85E20322426945E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="255267" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	2.9542326924097546
Encrypted:	false
SSDEEP:	6:kKX2lbN+SkQlPlEGYRMY9z+4KlDA3RUe/:elUkPlE99SNxAhUe/
MD5:	EB725F86D67CACF7DF8008A0854CD36F
SHA1:	B7C4062D15C45708B88D82C8468B0ABCF97BFD49
SHA-256:	DFA127441481996827C9C77CC897463F0405BA6F15B5D486365880DA5BADE7CB
SHA-512:	FB526105960F3BC803421E159C1F1419DFAAE60713A6697AF19FB1DBADC15BA861D3371DC1FE8EF90C5EFCBB4533C7944180A24B7C3941584EFDE336CC99B225
Malicious:	false
Preview:	p...... ..........=.$...(....................................................... ........M.....................i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\start.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\start.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhat92n4M6:ML9E4KlKDE4KhKiKhg84j
MD5:	AE6AF1A0CB468ECBA64E2D77CB4517DB
SHA1:	09BD6366ED569ADB79274BBAB0BBF09C8244FD97
SHA-256:	3A917DCBC4952EA9A1135B379B56604B3B63198E540C653683D522445258B710
SHA-512:	E578CD0D9BF43FD1BA737B9C44B70130462CE55B4F368E2E341BB94A3A3FFA47D4A9FE714EB86926620D1B4BE9FFF4582C219DF9ACC923C765650B13C5451500
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchos.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\svchos.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\LICENSE.electron.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\LICENSES.chromium.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	6766160
Entropy (8bit):	4.735324161006094
Encrypted:	false
SSDEEP:	24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
MD5:	180F8ACC70405077BADC751453D13625
SHA1:	35DC54ACAD60A98AEEC47C7ADE3E6A8C81F06883
SHA-256:	0BFA9A636E722107B6192FF35C365D963A54E1DE8A09C8157680E8D0FBBFBA1C
SHA-512:	40D3358B35EB0445127C70DEB0CB87EC1313ECA285307CDA168605A4FD3D558B4BE9EB24A59568ECA9EE1F761E578C39B2DEF63AD48E40D31958DB82F128E0EC
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\chrome_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	129690
Entropy (8bit):	7.91868310789661
Encrypted:	false
SSDEEP:	3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
MD5:	8626E1D68E87F86C5B4DABDF66591913
SHA1:	4CD7B0AC0D3F72587708064A7B0A3BECA3F7B81C
SHA-256:	2CAA1DA9B6A6E87BDB673977FEE5DD771591A1B6ED5D3C5F14B024130A5D1A59
SHA-512:	03BCD8562482009060F249D6A0DD7382FC94D669A2094DEC08E8D119BE51BEF2C3B7B484BB5B7F805AE98E372DAB9383A2C11A63AB0F5644146556B1BB9A4C99
Malicious:	false
Preview:	..............t...#.....:.I....yp....y6....y.....y#....y.....y`....ym....y.....y.....yI....y.....y'"...y.,...y.7...y;9...yv:...y(<...y.<...y.B...yfH...y.J...y.K...y.L.....M...N...aP...IS...BV...uY...]...Pa....d..&..h..'..i..(.hk..)..l....m..+.An..0..n..1.....2.....>.....?.....@.....A.....B.P...C.}...D.....F.9...H.r...I.I...J.....K.....L.....M.....N.6...O.....Q..%..R..(..T..1..U..4..W..>..X..H..^..M.._..N..`.mW..a.._..b..`..c.Cb..d.$d..e.Jg..g..g..i..k..j.m..k..n..l..p..m..s..n..s..o..u..p..v..r..y..s.\|{..u..~..v.<...x.....y.....~.......r..................................8................l.....;..... ......................p.....2..... .....8.....>.......................M.......................^.......................x...r.R...s.....t.....u.K...v.....w.....x.....y.+...z.~...{.....\|.....}.a...~.u....._..........._...........l...................................Y.......................;.................R.................w...........6.................].................z.......

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\chrome_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	179971
Entropy (8bit):	7.941375268079628
Encrypted:	false
SSDEEP:	3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
MD5:	48515D600258D60019C6B9C6421F79F6
SHA1:	0EF0B44641D38327A360AA6954B3B6E5AAB2AF16
SHA-256:	07BEE34E189FE9A8789AED78EA59AD41414B6E611E7D74DA62F8E6CA36AF01CE
SHA-512:	B7266BC8ABC55BD389F594DAC0C0641ECF07703F35D769B87E731B5FDF4353316D44F3782A4329B3F0E260DEAD6B114426DDB1B0FB8CD4A51E0B90635F1191D9
Malicious:	false
Preview:	..............t...#.....:.t....y.....y.....y.....y.....y.....y.....y.%...y....y.-...yc5...y.9...y.A...y.V...yCk...y.m...y)o...yyr...y#s...y.}...y.....y....y....y................................K....!.......&.....'....(.Q...)..........+....0....1.....2.....>.....?.f...@..$..A..&..B..)..C.1/..D.M:..F..<..H.JD..I.-K..J..P..K..V..L..\..M..^..N.Vc..O.?g..Q..p..R..t..T.g\|..U.X...W.....X.H...^....._.....`.....a.....b.b...c.....d.....e.....g.....i.....j.....k.....l.....m.....n.....o.....p.....r.....s.....u.....v.....x.....y.....~.............+...../.....4.....6.....8....T9.....9....~;.....=....q>.....@.....A....FD.....I.....M.....U.....].....c.....i.....o....Tu.....v.....w.....x.....y.....{.....\|.....}..........?.........r.....s.U...t.....u.....v....w.....x....y....z.....{....\|.<...}.....~.............1...........L..........z.................G...........X...........f...............@.....................q...........Y..........W...........;........................

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4891080
Entropy (8bit):	6.392150637672776
Encrypted:	false
SSDEEP:	49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccA:oy904wYbZCoOI85oyI
MD5:	CB9807F6CF55AD799E920B7E0F97DF99
SHA1:	BB76012DED5ACD103ADAD49436612D073D159B29
SHA-256:	5653BC7B0E2701561464EF36602FF6171C96BFFE96E4C3597359CD7ADDCBA88A
SHA-512:	F7C65BAE4EDE13616330AE46A197EBAD106920DCE6A31FD5A658DA29ED1473234CA9E2B39CC9833FF903FB6B52FF19E39E6397FAC02F005823ED366CA7A34F62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: rU6YAgkoAw.exe, Detection: malicious, Browse Filename: Mauqes.exe, Detection: malicious, Browse Filename: Tank-RevolutionDEMO.exe, Detection: malicious, Browse Filename: Google Digital Marketing .xlsx.exe, Detection: malicious, Browse Filename: Google Digital Marketing .xlsx.exe, Detection: malicious, Browse Filename: systemtest-standalone-10.12.3.exe, Detection: malicious, Browse Filename: systemtest-standalone-10.12.3.exe, Detection: malicious, Browse Filename: TrelloSetup.exe, Detection: malicious, Browse Filename: TrelloSetup.exe, Detection: malicious, Browse Filename: W1nnerFree CS2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c..Z....c...c../c....7..c.......c.......c..Z....c..Z...bc..Z....c..Z....c..Z...6c..Z.[..c..Z....c..Rich.c..................PE..d...-L............" ......8.........`.(...................................... K.....2.J...`A..........................................F.x.....F.P.....J.@.....H.......J..!....J......vD.p.....................<.(...P.<.8.............<.(............................text.....8.......8................. ..`.rdata...=....8..@....8.............@..@.data...@.....F.......F.............@....pdata........H.......G.............@..@.rsrc...@.....J.......I.............@..@.reloc........J.......I.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\ffmpeg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2862080
Entropy (8bit):	6.7042588011125215
Encrypted:	false
SSDEEP:	49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
MD5:	D49E7A8F096AD4722BD0F6963E0EFC08
SHA1:	6835F12391023C0C7E3C8CC37B0496E3A93A5985
SHA-256:	F11576BF7FFBC3669D1A5364378F35A1ED0811B7831528B6C4C55B0CDC7DC014
SHA-512:	CA50C28D6AAC75F749ED62EEC8ACBB53317F6BDCEF8794759AF3FAD861446DE5B7FA31622CE67A347949ABB1098ECCB32689B4F1C54458A125BC46574AD51575
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: rU6YAgkoAw.exe, Detection: malicious, Browse Filename: Tank-RevolutionDEMO.exe, Detection: malicious, Browse Filename: Google Digital Marketing .xlsx.exe, Detection: malicious, Browse Filename: Google Digital Marketing .xlsx.exe, Detection: malicious, Browse Filename: systemtest-standalone-10.12.3.exe, Detection: malicious, Browse Filename: systemtest-standalone-10.12.3.exe, Detection: malicious, Browse Filename: ForestOfDream.exe, Detection: malicious, Browse Filename: ForestOfDream.exe, Detection: malicious, Browse Filename: sims4c.exe, Detection: malicious, Browse Filename: RemasterSouls Setup.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......".........`.........................................B...........`A..........................................).......).(.............@.x.............A..2..D.).....................(.).(...."#.8.............).P............................text....."......."................. ..`.rdata...t....#..v....".............@..@.data...X......."...n.............@....pdata..x.....@.......*.............@..@.00cfg..(....@A......B+.............@..@.gxfg....+...PA..,...D+.............@..@.retplne\.....A......p+..................tls..........A......r+.............@....voltbl.8.....A......t+................._RDATA........A......v+.............@..@.reloc...2....A..4...x+.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	10541296
Entropy (8bit):	6.277012685259397
Encrypted:	false
SSDEEP:	98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7
MD5:	ADFD2A259608207F256AEADB48635645
SHA1:	300BB0AE3D6B6514FB144788643D260B602AC6A4
SHA-256:	7C8C7B05D70145120B45CCB64BF75BEE3C63FF213E3E64D092D500A96AFB8050
SHA-512:	8397E74C7A85B0A2987CAE9F2C66CE446923AA4140686D91A1E92B701E16B73A6CE459540E718858607ECB12659BEDAC0AA95C2713C811A2BC2D402691FF29DC
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@'..H..`.(..H...e).7H..0.).VH...).xH......H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	6.320849747462847
Encrypted:	false
SSDEEP:	12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
MD5:	09134E6B407083BAAEDF9A8C0BCE68F2
SHA1:	8847344CCEEAB35C1CDF8637AF9BD59671B4E97D
SHA-256:	D2107BA0F4E28E35B22837C3982E53784D15348795B399AD6292D0F727986577
SHA-512:	6FF3ADCB8BE48D0B505A3C44E6550D30A8FEAF4AA108982A7992ED1820C06F49E0AD48D9BD92685FB82783DFD643629BD1FE4073300B61346B63320CBDB051BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ................p.....................................................`A........................................x.......e-..(.......x........B..............$...4...........................(...@1..8............0...............................text...E........................... ..`.rdata..,....0......................@..@.data....K....... ..................@....pdata...B.......D..................@..@.00cfg..(....`......................@..@.gxfg...0$...p...&..................@..@.retplne\............4...................tls....!............6..............@....voltbl.8............8.................._RDATA...............:..............@..@.rsrc...x............<..............@..@.reloc..$............B..............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7514112
Entropy (8bit):	6.462467169487978
Encrypted:	false
SSDEEP:	98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
MD5:	A5F1921E6DCDE9EAF42E2CCC82B3D353
SHA1:	1F6F4DF99AE475ACEC4A7D3910BADB26C15919D1
SHA-256:	50C4DC73D69B6C0189EAB56D27470EE15F99BBBC12BFD87EBE9963A7F9BA404E
SHA-512:	0C24AE7D75404ADF8682868D0EBF05F02BBF603F7DDD177CF2AF5726802D0A5AFCF539DC5D68E10DAB3FCFBA58903871C9C81054560CF08799AF1CC88F33C702
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......X..........L.......................................s...........`A..........................................j.....N.j.d.....r.......o.PJ............r.....$.i.......................i.(.....X.8...........P.k.......j.@....................text.....X.......X................. ..`.rdata........X.......X.............@..@.data.........k..\|....k.............@....pdata..PJ....o..L...No.............@..@.00cfg..(....0r.......q.............@..@.gxfg...p*...@r..,....q.............@..@.retplne\....pr.......q..................tls....:.....r.......q.............@....voltbl.D.....r.......q................._RDATA........r.......q.............@..@.rsrc.........r.......q.............@..@.reloc........r.......q.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162036224
Entropy (8bit):	6.733016750711471
Encrypted:	false
SSDEEP:	1572864:OCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:0DAgZi
MD5:	94F3E2F32CED13FD99CC314BEB587233
SHA1:	1B7293564727A749658F5B7553A871E17BEB7527
SHA-256:	C98F0F5B89C6DAC1482286FAA2E33A84230C26EA38DA4E013665582C9A04213B
SHA-512:	3377804564E50D01D3C4B5376B0D40FB380E0911F3CE09BC6D8A01857AEBEE61D893877189AA719AAF394189AEE4B80D864443E81127534A13DC15F353DABB9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........."......v.....................@..........................................`...........................................D.od..e.H.T............p..,.@.............`.....:.......................:.(...`...8...........P,H......iD......................text....u.......v.................. ..`.rdata...`k......bk..\|..............@..@.data....bE...L.......K.............@....pdata..,.@..p....@...V.............@..@.00cfg..(............J..............@..@.gxfg....B.......B...L..............@..@.retplne.....`...........................rodata......p...................... ..`.tls................................@....voltbl.R...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..`.......

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	5430320
Entropy (8bit):	7.995406820581218
Encrypted:	true
SSDEEP:	98304:/Zgm9tHEEIcjWbEvKfwa2sEJFz993CNh1QeHQF5qrwrw5z0uxRRrY2kuDYj9ds:RgAtkEx4EKfatyNhHwFkkrw5IcRRtkFs
MD5:	7971A016AED2FB453C87EB1B8E3F5EB2
SHA1:	92B91E352BE8209FADCF081134334DEA147E23B8
SHA-256:	9CFD5D29CDE3DE2F042E5E1DA629743A7C95C1211E1B0B001E4EEBC0F0741E06
SHA-512:	42082AC0C033655F2EDAE876425A320D96CDAEE6423B85449032C63FC0F7D30914AA3531E65428451C07912265B85F5FEE2ED0BBDB362994D3A1FA7B14186013
Malicious:	false
Preview:	............f.R......&....h).....,...4_?...4.G...4.J...4.\...4.e...4.l...4Ho...4.u...4.w...4.y...4.}...4....4&....4H....4.....4....4.....4F....4.....4.....4[....4d....4e....4.....4.....4.....4l....4.....4.....4.....4.....4g....4.....5.....5?....5.....5.....5H....5.:...5.=..~5]D...5oE...5;F...57H...5.H...5mI...5}M...56O...5.T...5{y...5c....5.....5.....5.....5.....5.....5G....5W....<.....<Y(...<....<j,...<N-...<.1..,<.2..-</=...<.H../<.T..0<._...@.p...@.x...@g\|...@}}...@.~...@.i...Agv...A]x...A.....A.....A'....A....A.....A.....AT....Al....A.....A.....Ao....A$....A.....A2....A=....Ae....A.....A.....AS!...A.%...AH,...Am:...AM<...A:>...A.@...AuB...A.C.. AZF...N....N.....N.....Nc....NL....N....NM....N.....O.....O}....O.....O.....O#....O.....O}....O.....Od....O4....O.....O.0...O.7...Og>...O.A..$O.W..%O.Y..&O]c..'O.d..(O.i..)O.k..Opm..+O.x..,O(\|..-Oq....O..../O....0O....1O...2Og...3O....4O....5Ot...6O....7O....8OV...9OB...:O....;Om...<O....=O....>O....?Om...@OI...AO....BO....CO....DO..

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\snapshot_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	162352
Entropy (8bit):	4.860588090157433
Encrypted:	false
SSDEEP:	1536:uebVb91USSzM+uCPNgswpzHD41OzB965pUB8/DR9BgyLMRPoq/rX4JHj/kMKE0YC:uTgsED41OV965LXMj4zF2Xl9B
MD5:	8FEF5A96DBCC46887C3FF392CBDB1B48
SHA1:	ED592D75222B7828B7B7AAB97B83516F60772351
SHA-256:	4DE0F720C416776423ADD7ADA621DA95D0D188D574F08E36E822AD10D85C3ECE
SHA-512:	E52C7820C69863ECC1E3B552B7F20DA2AD5492B52CAC97502152EBFF45E7A45B00E6925679FD7477CDC79C68B081D6572EEED7AED773416D42C9200ACCC7230E
Malicious:	false
Preview:	.........4D11.0.226.20-electron.0...........................................6.. ...`.......06..a........a........a........ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	476792
Entropy (8bit):	5.595608653079527
Encrypted:	false
SSDEEP:	3072:qqgtKzy7vqUSMd+5ZTR4ymbsLIniZiYIU+gTh3WOdvmttow2LyZDvooPmdZwmNgi:lgEzy2NTROsLftIU+gTQ4E2ro+dOmp
MD5:	A373D83D4C43BA957693AD57172A251B
SHA1:	8E0FDB714DF2F4CB058BEB46C06AA78F77E5FF86
SHA-256:	43B58CA4057CF75063D3B4A8E67AA9780D9A81D3A21F13C64B498BE8B3BA6E0C
SHA-512:	07FBD84DC3E0EC1536CCB54D5799D5ED61B962251ECE0D48E18B20B0FC9DD92DE06E93957F3EFC7D9BED88DB7794FE4F2BEC1E9B081825E41C6AC3B4F41EAB18
Malicious:	false
Preview:	.........K..11.0.226.20-electron.0..............................................`....f..8...........h...a........a........aT.......ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5209088
Entropy (8bit):	6.329767466271418
Encrypted:	false
SSDEEP:	49152:tG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAq:c7iDPqjvzO1Lhgf49zT7grg4
MD5:	A0845E0774702DA9550222AB1B4FDED7
SHA1:	65D5BD6C64090F0774FD0A4C9B215A868B48E19B
SHA-256:	6150A413EBE00F92F38737BDCCF493D19921EF6329FCD48E53DE9DBDE4780810
SHA-512:	4BE0CB1E3C942A1695BAE7B45D21C5F70E407132ECC65EFB5B085A50CDAB3C33C26E90BD7C86198EC40FB2B18D026474B6C649776A3CA2CA5BFF6F922DE2319B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......?..........&8...................................... Q...........`A........................................X.J.~.....J.P.....P.......N..c............P..}....J.....................h.J.(...@.?.8...........x.K.P............................text...".?.......?................. ..`.rdata..$.....?.. ....?.............@..@.data...`.....K.......K.............@....pdata...c....N..d...\M.............@..@.00cfg..(.....P.......N.............@..@.gxfg...`,... P.......N.............@..@.retplne\....PP.......N..................tls....Q....`P.......N.............@....voltbl.8....pP.......N................._RDATA........P.......N.............@..@.rsrc.........P.......N.............@..@.reloc...}....P..~....N.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\build.exe

Download File

Process:	C:\Users\user\Desktop\Sldl84wxy8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	65711823
Entropy (8bit):	7.999943485811978
Encrypted:	true
SSDEEP:	1572864:9rziNh/b8cKauEXEnREpwWGD5Pb2PKDLrWE36D77:Yh/Tu+W/kvEKf7
MD5:	8701FCD188315FA69245FB99E07DF60D
SHA1:	511FF357D2BA1EAE568E54627C115218AC9C2F27
SHA-256:	A60C94ED95D06FDEC41A1665413BDE68A9B501C2781417848AC3D60631163001
SHA-512:	826AA81D962EA6C1D8C8B3B4471136A5EA5AD1844D92289859D7A951B339FC7BA06386AD3D71BFBDD02538DDA98F107ED28BB1655E58BDA727798DBDEA67F21B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 15%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@..........................p.......{....@..........................................................................................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\LICENSE.electron.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\LICENSES.chromium.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	6766160
Entropy (8bit):	4.735324161006094
Encrypted:	false
SSDEEP:	24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
MD5:	180F8ACC70405077BADC751453D13625
SHA1:	35DC54ACAD60A98AEEC47C7ADE3E6A8C81F06883
SHA-256:	0BFA9A636E722107B6192FF35C365D963A54E1DE8A09C8157680E8D0FBBFBA1C
SHA-512:	40D3358B35EB0445127C70DEB0CB87EC1313ECA285307CDA168605A4FD3D558B4BE9EB24A59568ECA9EE1F761E578C39B2DEF63AD48E40D31958DB82F128E0EC
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\chrome_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	129690
Entropy (8bit):	7.91868310789661
Encrypted:	false
SSDEEP:	3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
MD5:	8626E1D68E87F86C5B4DABDF66591913
SHA1:	4CD7B0AC0D3F72587708064A7B0A3BECA3F7B81C
SHA-256:	2CAA1DA9B6A6E87BDB673977FEE5DD771591A1B6ED5D3C5F14B024130A5D1A59
SHA-512:	03BCD8562482009060F249D6A0DD7382FC94D669A2094DEC08E8D119BE51BEF2C3B7B484BB5B7F805AE98E372DAB9383A2C11A63AB0F5644146556B1BB9A4C99
Malicious:	false
Preview:	..............t...#.....:.I....yp....y6....y.....y#....y.....y`....ym....y.....y.....yI....y.....y'"...y.,...y.7...y;9...yv:...y(<...y.<...y.B...yfH...y.J...y.K...y.L.....M...N...aP...IS...BV...uY...]...Pa....d..&..h..'..i..(.hk..)..l....m..+.An..0..n..1.....2.....>.....?.....@.....A.....B.P...C.}...D.....F.9...H.r...I.I...J.....K.....L.....M.....N.6...O.....Q..%..R..(..T..1..U..4..W..>..X..H..^..M.._..N..`.mW..a.._..b..`..c.Cb..d.$d..e.Jg..g..g..i..k..j.m..k..n..l..p..m..s..n..s..o..u..p..v..r..y..s.\|{..u..~..v.<...x.....y.....~.......r..................................8................l.....;..... ......................p.....2..... .....8.....>.......................M.......................^.......................x...r.R...s.....t.....u.K...v.....w.....x.....y.+...z.~...{.....\|.....}.a...~.u....._..........._...........l...................................Y.......................;.................R.................w...........6.................].................z.......

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\chrome_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	179971
Entropy (8bit):	7.941375268079628
Encrypted:	false
SSDEEP:	3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
MD5:	48515D600258D60019C6B9C6421F79F6
SHA1:	0EF0B44641D38327A360AA6954B3B6E5AAB2AF16
SHA-256:	07BEE34E189FE9A8789AED78EA59AD41414B6E611E7D74DA62F8E6CA36AF01CE
SHA-512:	B7266BC8ABC55BD389F594DAC0C0641ECF07703F35D769B87E731B5FDF4353316D44F3782A4329B3F0E260DEAD6B114426DDB1B0FB8CD4A51E0B90635F1191D9
Malicious:	false
Preview:	..............t...#.....:.t....y.....y.....y.....y.....y.....y.....y.%...y....y.-...yc5...y.9...y.A...y.V...yCk...y.m...y)o...yyr...y#s...y.}...y.....y....y....y................................K....!.......&.....'....(.Q...)..........+....0....1.....2.....>.....?.f...@..$..A..&..B..)..C.1/..D.M:..F..<..H.JD..I.-K..J..P..K..V..L..\..M..^..N.Vc..O.?g..Q..p..R..t..T.g\|..U.X...W.....X.H...^....._.....`.....a.....b.b...c.....d.....e.....g.....i.....j.....k.....l.....m.....n.....o.....p.....r.....s.....u.....v.....x.....y.....~.............+...../.....4.....6.....8....T9.....9....~;.....=....q>.....@.....A....FD.....I.....M.....U.....].....c.....i.....o....Tu.....v.....w.....x.....y.....{.....\|.....}..........?.........r.....s.U...t.....u.....v....w.....x....y....z.....{....\|.<...}.....~.............1...........L..........z.................G...........X...........f...............@.....................q...........Y..........W...........;........................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4891080
Entropy (8bit):	6.392150637672776
Encrypted:	false
SSDEEP:	49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccA:oy904wYbZCoOI85oyI
MD5:	CB9807F6CF55AD799E920B7E0F97DF99
SHA1:	BB76012DED5ACD103ADAD49436612D073D159B29
SHA-256:	5653BC7B0E2701561464EF36602FF6171C96BFFE96E4C3597359CD7ADDCBA88A
SHA-512:	F7C65BAE4EDE13616330AE46A197EBAD106920DCE6A31FD5A658DA29ED1473234CA9E2B39CC9833FF903FB6B52FF19E39E6397FAC02F005823ED366CA7A34F62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c..Z....c...c../c....7..c.......c.......c..Z....c..Z...bc..Z....c..Z....c..Z...6c..Z.[..c..Z....c..Rich.c..................PE..d...-L............" ......8.........`.(...................................... K.....2.J...`A..........................................F.x.....F.P.....J.@.....H.......J..!....J......vD.p.....................<.(...P.<.8.............<.(............................text.....8.......8................. ..`.rdata...=....8..@....8.............@..@.data...@.....F.......F.............@....pdata........H.......G.............@..@.rsrc...@.....J.......I.............@..@.reloc........J.......I.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\ffmpeg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2862080
Entropy (8bit):	6.7042588011125215
Encrypted:	false
SSDEEP:	49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
MD5:	D49E7A8F096AD4722BD0F6963E0EFC08
SHA1:	6835F12391023C0C7E3C8CC37B0496E3A93A5985
SHA-256:	F11576BF7FFBC3669D1A5364378F35A1ED0811B7831528B6C4C55B0CDC7DC014
SHA-512:	CA50C28D6AAC75F749ED62EEC8ACBB53317F6BDCEF8794759AF3FAD861446DE5B7FA31622CE67A347949ABB1098ECCB32689B4F1C54458A125BC46574AD51575
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......".........`.........................................B...........`A..........................................).......).(.............@.x.............A..2..D.).....................(.).(...."#.8.............).P............................text....."......."................. ..`.rdata...t....#..v....".............@..@.data...X......."...n.............@....pdata..x.....@.......*.............@..@.00cfg..(....@A......B+.............@..@.gxfg....+...PA..,...D+.............@..@.retplne\.....A......p+..................tls..........A......r+.............@....voltbl.8.....A......t+................._RDATA........A......v+.............@..@.reloc...2....A..4...x+.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	10541296
Entropy (8bit):	6.277012685259397
Encrypted:	false
SSDEEP:	98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7
MD5:	ADFD2A259608207F256AEADB48635645
SHA1:	300BB0AE3D6B6514FB144788643D260B602AC6A4
SHA-256:	7C8C7B05D70145120B45CCB64BF75BEE3C63FF213E3E64D092D500A96AFB8050
SHA-512:	8397E74C7A85B0A2987CAE9F2C66CE446923AA4140686D91A1E92B701E16B73A6CE459540E718858607ECB12659BEDAC0AA95C2713C811A2BC2D402691FF29DC
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@'..H..`.(..H...e).7H..0.).VH...).xH......H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	6.320849747462847
Encrypted:	false
SSDEEP:	12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
MD5:	09134E6B407083BAAEDF9A8C0BCE68F2
SHA1:	8847344CCEEAB35C1CDF8637AF9BD59671B4E97D
SHA-256:	D2107BA0F4E28E35B22837C3982E53784D15348795B399AD6292D0F727986577
SHA-512:	6FF3ADCB8BE48D0B505A3C44E6550D30A8FEAF4AA108982A7992ED1820C06F49E0AD48D9BD92685FB82783DFD643629BD1FE4073300B61346B63320CBDB051BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ................p.....................................................`A........................................x.......e-..(.......x........B..............$...4...........................(...@1..8............0...............................text...E........................... ..`.rdata..,....0......................@..@.data....K....... ..................@....pdata...B.......D..................@..@.00cfg..(....`......................@..@.gxfg...0$...p...&..................@..@.retplne\............4...................tls....!............6..............@....voltbl.8............8.................._RDATA...............:..............@..@.rsrc...x............<..............@..@.reloc..$............B..............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7514112
Entropy (8bit):	6.462467169487978
Encrypted:	false
SSDEEP:	98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
MD5:	A5F1921E6DCDE9EAF42E2CCC82B3D353
SHA1:	1F6F4DF99AE475ACEC4A7D3910BADB26C15919D1
SHA-256:	50C4DC73D69B6C0189EAB56D27470EE15F99BBBC12BFD87EBE9963A7F9BA404E
SHA-512:	0C24AE7D75404ADF8682868D0EBF05F02BBF603F7DDD177CF2AF5726802D0A5AFCF539DC5D68E10DAB3FCFBA58903871C9C81054560CF08799AF1CC88F33C702
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......X..........L.......................................s...........`A..........................................j.....N.j.d.....r.......o.PJ............r.....$.i.......................i.(.....X.8...........P.k.......j.@....................text.....X.......X................. ..`.rdata........X.......X.............@..@.data.........k..\|....k.............@....pdata..PJ....o..L...No.............@..@.00cfg..(....0r.......q.............@..@.gxfg...p*...@r..,....q.............@..@.retplne\....pr.......q..................tls....:.....r.......q.............@....voltbl.D.....r.......q................._RDATA........r.......q.............@..@.rsrc.........r.......q.............@..@.reloc........r.......q.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\af.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	362355
Entropy (8bit):	5.4138809970208035
Encrypted:	false
SSDEEP:	6144:j54QCpN9/WiHIR9a5D4+kQMGSB+jC6kAw1TUKKpg3b9xIsVxSt2y5qP3ux5tPwDV:F9CpN9OiHIRX+HMT+jC6kAw1TYpg3b9P
MD5:	464E5EEABA5EFF8BC93995BA2CB2D73F
SHA1:	3B216E0C5246C874AD0AD7D3E1636384DAD2255D
SHA-256:	0AD547BB1DC57907ADEB02E1BE3017CCE78F6E60B8B39395FE0E8B62285797A1
SHA-512:	726D6C41A9DBF1F5F2EFF5B503AB68D879B088B801832C13FBA7EB853302B16118CACDA4748A4144AF0F396074449245A42B2FE240429B1AFCB7197FA0CB6D41
Malicious:	false
Preview:	..........].h.(...i.0...j.<...k.K...l.V...n.^...o.c...p.p...r.v...s.....t.....v.....w.....y.....z.....\|.....}................................................................... .....M.....Z.....i.....z...........................................................!.....4.....T.....[.....k.....{...........................................................$.....4.....B.....x.............................................................................2.....K.....g.....u.....}........................................................... .....0.....L.....a.......................................................................9.....N.....g.....n.....q.....r.....~.........................................D.....L.......................................................................'.....<.....^.....q................................................... .....".....%.D...(.`...*.....+.....,.........../.....0.....1.....3.....4.+...5.F...6.....7.....8.....9.....<.....=.....>.....?.....@.....A.8...C.`...D.g.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\am.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	583572
Entropy (8bit):	4.947180410657857
Encrypted:	false
SSDEEP:	12288:QqhqEuPxT8xZTtWosuF9Q5m9yAAVzfukCQox30jH8+I:Zh8T8xTWoZF9Q5m9yAAVzXCQ0
MD5:	2C933F084D960F8094E24BEE73FA826C
SHA1:	91DFDDC2CFF764275872149D454A8397A1A20AB1
SHA-256:	FA1E44215BD5ACC7342C431A3B1FDDB6E8B6B02220B4599167F7D77A29F54450
SHA-512:	3C9ECFB0407DE2AA6585F4865AD54EEB2EC6519C9D346E2D33ED0E30BE6CC3EBFED676A08637D42C2CA8FA6CFEFB4091FEB0C922FF71F09A2B89CDD488789774
Malicious:	false
Preview:	..........Q.h.@...i.K...j.W...k.f...l.q...n.y...o.~...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................&.....-.....4.....5.....6.....;.....g........................................./.....7.....\|...............................................A.....a.....q............................./.....R.....d.....m.............................4.....@.....O.....e...............................................I.....{............................................... .....3.....h.....w.............................:.....R.............................).....H.....n.....q.......................'.....G.....p.....w.....z.....{.........................................l.................".....B....._.....................................................;.....c.................).....u....................................... .....".0...%.f...(.....*.....+.....,.........../.....0.1...1.....3.....4.....5.....6.{...7.....8.....9.....;.....<.....=.5...>.o...?.y...@.....A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\ar.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	639744
Entropy (8bit):	4.950537001099058
Encrypted:	false
SSDEEP:	12288:K+sgtqIj5/XvYUtOkQIkqBJ5SNbW+eTtvZEMgSENjM:KD4Fek75z+K
MD5:	FDBAD4C84AC66EE78A5C8DD16D259C43
SHA1:	3CE3CD751BB947B19D004BD6916B67E8DB5017AC
SHA-256:	A62B848A002474A8EA37891E148CBAF4AF09BDBA7DAFEBDC0770C9A9651F7E3B
SHA-512:	376519C5C2E42D21ACEDB1EF47184691A2F286332451D5B8D6AAC45713861F07C852FB93BD9470FF5EE017D6004ABA097020580F1BA253A5295AC1851F281E13
Malicious:	false
Preview:	........~.z.h.....i.....j.....k.....l.....n.'...o.,...p.9...r.?...s.P...t.Y...v.n...w.{...y.....z.....\|.....}...................................................................).....B....._.........................................-....._.....b.....f.........................................0.....G...................................................../.....O...............................................-.....7.....g.............................5.....`...............................................K.....[.....r.............................a.........................................".....=.....\.....w.................................................................V.......................o.............................<.....Y.....i.....q.....}.......................<.....^.........................................<.....M... ._...".\|...%.....(.....*.M...+.P...,.n........./.....0.....1.....3.....4.=...5.d...6.....7.....8.....9.6...;.Q...<.r...=.....>.....?.....@.....A.....C.....D.....E.Y...F...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\bg.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	667826
Entropy (8bit):	4.715111408941832
Encrypted:	false
SSDEEP:	12288:MMq8w2kMLlYrdAs1aQUx41aVVwslMLOmFOMw35uKN31tfbDMxbV2Jfu64Kjz5fS+:MMqckulYrdAs1aQUmBsmRw35uK7Jgxho
MD5:	38BCABB6A0072B3A5F8B86B693EB545D
SHA1:	D36C8549FE0F69D05FFDAFFA427D3DDF68DD6D89
SHA-256:	898621731AC3471A41F8B3A7BF52E7F776E8928652B37154BC7C1299F1FD92E1
SHA-512:	002ADBDC17B6013BECC4909DAF2FEBB74CE88733C78E968938B792A52C9C5A62834617F606E4CB3774AE2DAD9758D2B8678D7764BB6DCFE468881F1107DB13EF
Malicious:	false
Preview:	..........S.h.<...i.D...j.P...k._...l.j...n.r...o.w...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....4.........................................:.....F.....P.........................................Q.....]...................................,.....V.........................................7...................................9.....?.....M.....a.......................9.....i.........................................(.....N.....x.......................=.....X.....n.......................Z.....s...................................8.....h.......................+.....2.....5.....6.....J.....`.....\|.................(...........B.....N.................>...................................,.....6.....j.................7.....s.................?.....Q.....g..................... .....".....%.U...(.....*.....+.....,....... .../.N...0.W...1.....3.....4.....5.N...6.....7.....8.....9.@...;.m...<.....=.....>.....?.....@.....A.D...C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\bn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	858553
Entropy (8bit):	4.32277927640417
Encrypted:	false
SSDEEP:	3072:6gGTLRFbMdhBVHvr5eSnC6PRWhk7Bbd8+D95H0XluZ:YWBlvr5FCYRWuBbdB5wl2
MD5:	9340520696E7CB3C2495A78893E50ADD
SHA1:	EED5AEEF46131E4C70CD578177C527B656D08586
SHA-256:	1EA245646A4B4386606F03C8A3916A3607E2ADBBC88F000976BE36DB410A1E39
SHA-512:	62507685D5542CFCD394080917B3A92CA197112FEEA9C2DDC1DFC77382A174C7DDF758D85AF66CD322692215CB0402865B2A2B212694A36DA6B592028CAAFCDF
Malicious:	false
Preview:	..........].h.(...i.9...j.E...k.T...l._...n.g...o.m...p.z...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................!.....(.....)........../.......................9.....K.....g.............................R.....T.....X.......................&.....[.............................E.....x.......................-.....O.....}.................e.....t.........................................5.....q.................2.....r.........................................-.....I.......................x...............................................@.....r.............................5.....c...............................................6.....M.....n.................1.....I.......................f.........................................@.................i...............................................J.....h... .}...".....%.....(.P........,.........../.....0.....1.....3.....4.....5.^...6.....7.....8.u...9.....;.....<.....=.....>.R...?.e...@.....A.....C.c...D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\ca.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	409695
Entropy (8bit):	5.417085582145732
Encrypted:	false
SSDEEP:	12288:bgoRVrijIs3cejEYBCqS4o3nbhjJSwHQliEwfwVEMXdLbpuQ16BtryBiGIle3nei:b3GQUwJAMNTCypxB5WMml
MD5:	4CD6B3A91669DDCFCC9EEF9B679AB65C
SHA1:	43C41CB00067DE68D24F72E0F5C77D3B50B71F83
SHA-256:	56EFFF228EE3E112357D6121B2256A2C3ACD718769C89413DE82C9D4305459C6
SHA-512:	699BE9962D8AAE241ABD1D1F35CD8468FFBD6157BCD6BDF2C599D902768351B247BAAD6145B9826D87271FD4A19744EB11BF7065DB7FEFB01D66D2F1F39015A9
Malicious:	false
Preview:	..........R.h.>...i.F...j.R...k.a...l.l...n.t...o.y...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................!.....(...../.....0.....1.....3.....\.....v...............................................&.....D.....F.....J.....r.....................................................%.....5.....S.....n.....q.....{.........................................%.....5.....8.....;.....D.....X.....n.....................................................#.....5.....D.....U.....k.....r...................................'.....H.....Q.....b.....u.....................................................).....0.....3.....4.....=.....F.....N.....T.....f.................,.....4.....o.........................................$...../.....4.....J.....t.............................%.....>.....C.....M.....^.....z......... .....".....%.....(.....*.....+.....,.&.....P.../.m...0.r...1.....3.....4.....5.....6.1...7.B...8.V...9.h...;.v...<.....=.....>.....?.....@.....A.....C.....D.&...E.Z.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\cs.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	419829
Entropy (8bit):	5.845882900283008
Encrypted:	false
SSDEEP:	6144:RquUIAMYOnQYeAIV4g558YwGKNDsku8Qy:Rq/IA5On504g558YwbNDsC
MD5:	EEEE212072EA6589660C9EB216855318
SHA1:	D50F9E6CA528725CED8AC186072174B99B48EA05
SHA-256:	DE92F14480770401E39E22DCF3DD36DE5AD3ED22E44584C31C37CD99E71C4A43
SHA-512:	EA068186A2E611FB98B9580F2C5BA6FD1F31B532E021EF9669E068150C27DEEE3D60FD9FF7567B9EB5D0F98926B24DEFABC9B64675B49E02A6F10E71BB714AC8
Malicious:	false
Preview:	..........s.h.....i.....j.....k.....l....n.2...o.7...p.D...r.J...s.[...t.d...v.y...w.....y.....z.....\|.....}.........................................................................+.....;.....M....._.....h.....u...............................................G.....].....{.....................................................1.....@.....F.....M.....^.....p.................................................................0.....E.....[.....t.................................................................+.....6.....H.........................................".....(.....4.....@.....P.....u.....x.........................................................................................].......................A.....^.....z...............................................!.....G.....b.............................,.....3.....=.....J.....g.....q... .y...".....%.....(..........+.....,.......(.../.?...0.I...1.....3.....4.....5.....6.....7. ...8.6...9.L...<.^...=.h...>.}...?.....@.....A.....C.....D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\da.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	380107
Entropy (8bit):	5.46366244634788
Encrypted:	false
SSDEEP:	6144:czP4qlrn8+ua0swlGVJJwoXlw5CvET5VTrBGzO7iJyd4tTWwT:dqlr89JklwH55rETL
MD5:	E7BA94C827C2B04E925A76CB5BDD262C
SHA1:	ABBA6C7FCEC8B6C396A6374331993C8502C80F91
SHA-256:	D8DA7AB28992C8299484BC116641E19B448C20ADF6A8B187383E2DBA5CD29A0B
SHA-512:	1F44FCE789CF41FD62F4D387B7B8C9D80F1E391EDD2C8C901714DD0A6E3AF32266E9D3C915C15AD47C95ECE4C7D627AA7339F33EEA838D1AF9901E48EDB0187E
Malicious:	false
Preview:	..........H.h.R...i.c...j.o...k.~...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....y...........................................................+.....-.....1.....Y.....n.................................................................-.....3.....;.....K.....o.......................................................................,.....C.....Y.....s.............................................................................?.....H.....i................................................................. .....+.....?.....Q.....e.....l.....o.....p.....w.........................................S.....W.................................................................".....?.....V...............................................".....5.....?... .C...".K...%.f...(.....*.....+.....,.........../.....0.....1.9...3.E...4._...5.w...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.(...A._...C.\|...D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\de.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	406584
Entropy (8bit):	5.519300999448185
Encrypted:	false
SSDEEP:	6144:V3JEmQ1hqVK+6aU8WUmzg3ELWzhqY305QgfXlIsCJd:V5t6sKXaK/LWy5POsCJd
MD5:	CF22EC11A33BE744A61F7DE1A1E4514F
SHA1:	73E84848C6D9F1A2ABE62020EB8C6797E4C49B36
SHA-256:	7CC213E2C9A2D2E2E463083DD030B86DA6BBA545D5CEE4C04DF8F80F9A01A641
SHA-512:	C10C8446E3041D7C0195DA184A53CFBD58288C06EAF8885546D2D188B59667C270D647FA7259F5CE140EC6400031A7FC060D0F2348AB627485E2207569154495
Malicious:	false
Preview:	........S...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.+...y.1...z.@...\|.F...}.X.....`.....e.....m.....u.....}............................................................................./.....7.....@.....f.....\|.....~.....................................................%.....M.....a.....o...............................................8.....L.....S.....^.....v.....................................................6....._.......................................................................7.....H.....a.....r...............................................".....5.....K....._.....x.................................................................?.............................#.....M.....x...........................................................(.....F.....j............................................. .....".....%.1...(.N...*.q...+.t...,.........../.....0.....1.....3.....4.....5.7...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.....A.>...C.]...D.g.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\el.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	729549
Entropy (8bit):	4.799528683257041
Encrypted:	false
SSDEEP:	12288:AQbueXYquNw2202pgtZBAujt4NIbsJvaP5A3HRsgQiEYQ3C1gf2ns4CfFnx1Xu2v:B2quNw2202pgtHAujmNrJvaRA3HRsDik
MD5:	E66A75680F21CE281995F37099045714
SHA1:	D553E80658EE1EEA5B0912DB1ECC4E27B0ED4790
SHA-256:	21D1D273124648A435674C7877A98110D997CF6992469C431FE502BBCC02641F
SHA-512:	D3757529DD85EF7989D9D4CECF3F7D87C9EB4BEDA965D8E2C87EE23B8BAAEC3FDFF41FD53BA839215A37404B17B8FE2586B123557F09D201B13C7736C736B096
Malicious:	false
Preview:	..........U.h.8...i.@...j.J...k.Y...l.d...n.l...o.q...p.~...r.....s.....t.....v.....w.....y.....z.....\|.....}........................................... .....'.....(.....).....+.............................&.....O.....~.........................................9.....g.............................1.....H.............................<.....T.....b......................./.....h.....p.........................................+.....].......................t.................................../.....T.....m.......................:.....].....n.................>.........................................".....E.....h.............................#.....&.....'.....C.....].....o.................4...........X.....h...........>.....x.................7.....P.....d.....w......................./.....................................................V.....k... .~...".....%.....(.....*.s...+.v...,.........../.....0.3...1.....3.....4.!...5._...6.....7.....8.=...9.\...;.....<.....=.....>.....?.....@.>...A.~...C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\en-GB.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	331921
Entropy (8bit):	5.529632303060999
Encrypted:	false
SSDEEP:	6144:k6QL0f35ubiwMP9egutWbfaYX2YBB5HXSdBruC:6LduwMetW92M53SuC
MD5:	825ED4C70C942939FFB94E77A4593903
SHA1:	7A3FAEE9BF4C915B0F116CB90CEC961DDA770468
SHA-256:	E11E8DB78AE12F8D735632BA9FD078EC66C83529CB1FD86A31AB401F6F833C16
SHA-512:	41325BEC22AF2E5EF8E9B26C48F2DFC95763A249CCB00E608B7096EC6236AB9A955DE7E2340FD9379D09AC2234AEE69AED2A24FE49382FFD48742D72A929C56A
Malicious:	false
Preview:	............h.....i.....j.....k.....l.....n.....o.#...p.0...r.6...s.G...t.P...v.e...w.r...y.x...z.....\|.....}.....................................................................................$.....4.....;.....D.....[.....c.....m.......................................................................&.....A.....S.....b.....\|.......................................................................(.....,...../.....5.....E.....T.....b.....{.............................................................................$.....S.....].....i.................................................................0.....@.....P.....e.....z.............................................................................A.....H.....x.............................................................................@.....U.....l............................................. .....".....%.....(.....*.6...+.9...,.W.....h.../.v...0.....1.....3.....4.....5.....6.....7.....8.C...9.P...;.a...<.i...=.t...>.....?.....@.....A...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\en-US.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	334693
Entropy (8bit):	5.521172766448584
Encrypted:	false
SSDEEP:	6144:Mvneu710gxhmrunGeuMP9eczCPMfaYbg3In5N+Sqn8BcwS:Ml0gxvNuMbCPmgA5YSNcwS
MD5:	19D18F8181A4201D542C7195B1E9FF81
SHA1:	7DEBD3CF27BBE200C6A90B34ADACB7394CB5929C
SHA-256:	1D20E626444759C2B72AA6E998F14A032408D2B32F957C12EC3ABD52831338FB
SHA-512:	AF07E1B08BBF2DD032A5A51A88EE2923650955873753629A086CAD3B1600CE66CA7F9ED31B8CA901C126C10216877B24E123144BB0048F2A1E7757719AAE73F2
Malicious:	false
Preview:	........&...h.>...i.F...j.R...k.a...l.l...n.t...o.y...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................!.....(...../.....0.....1.....6.....^.....k.....z................................................................. .....0.....G.....K.....V.....f.....m.....y.................................................................C.....V.....Z.....b.....n.....{.............................................................................$.....+.....1.....:.....E.....b.....i.....x.........................................3.....<.....E.....O.....].....p.....s...............................................................................................@.....m...........................................................%................>.....X.....q.....................................................&......... .2...".;...%.[...(.r........+.....,.........../.....0.....1.....3.....4.)...5.@...6.r...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.!.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\es-419.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	404903
Entropy (8bit):	5.392122812912978
Encrypted:	false
SSDEEP:	3072:75rkwZKG5KJo0ZyFPK9zj4rMY4rjyujd8pyPWncpwwfNEOv553l50GLFddhRIHKj:t1K2YZIK9BYgapFGl5dLFddA7Fcp
MD5:	7DA3E8AA47BA35D014E1D2A32982A5BB
SHA1:	8E35320B16305AD9F16CB0F4C881A89818CD75BB
SHA-256:	7F85673CF80D1E80ACFC94FB7568A8C63DE79A13A1BB6B9D825B7E9F338EF17C
SHA-512:	1FCA90888EB067972BCCF74DD5D09BB3FCE2CEB153589495088D5056ED4BDEDE15D54318AF013C2460F0E8B5B1A5C6484ADF0ED84F4B0B3C93130B086DA5C3BF
Malicious:	false
Preview:	..........=.h.h...i.q...j.}...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^...........................................................'.....>.....@.....D.....p...........................................................(.....H.....b.....g.....o.........................................#.....9.....N.....T.....W.....].....t...................................@.....P.....V.....^.....e.....x...............................................&.....2.....a.................................................................1.....I....._.....f.....i.....j.....s.....\|.............................0.....t.....\|.......................3.....B.....\.....m.....x..............................................I............................................. .....".....%.(...(.A....]...+.`...,.~........./.....0.....1.....3.....4.3...5.V...6.....7.....8.....9.....;.....<.....=.....>.!...?.+...@.@...A.s...C.....D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\es.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	404348
Entropy (8bit):	5.362527979144936
Encrypted:	false
SSDEEP:	6144:/Q0DA42b4XUx+SCHgfUcp9Ch48BKjbu5mrj7o2oxjm6PZqJ:YK2b40P9pchXgjbu5mrroNSJ
MD5:	04A9BA7316DC81766098E238A667DE87
SHA1:	24D7EB4388ECDFECADA59C6A791C754181D114DE
SHA-256:	7FA148369C64BC59C2832D617357879B095357FE970BAB9E0042175C9BA7CB03
SHA-512:	650856B6187DF41A50F9BED29681C19B4502DE6AF8177B47BAD0BF12E86A25E92AA728311310C28041A18E4D9F48EF66D5AD5D977B6662C44B49BFD1DA84522B
Malicious:	false
Preview:	..........J.h.N...i.V...j.b...k.q...l.\|...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}........................."..........1.....8.....?.....@.....A.....C.....r...........................................................2.....4.....8.....`.................................................................:.....T.....Y.....a.....s...............................................&.....,...../.....5.....L.....k............................. .....0.....6.....>.....E.....X.....e.....v...............................................F.....m.....x.................................................................B.....I.....L.....M.....V....._.....h.....o.......................k.....s.......................).....8.....R.....c.....n.....z.........................................2.....f....................................... .....".....%.....(.!....@...+.C...,.a.....{.../.....0.....1.....3.....4.....5."...6.n...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.B...C.i...D.s.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\et.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	365447
Entropy (8bit):	5.471951090286899
Encrypted:	false
SSDEEP:	6144:U/RGRpph+2n4x6i05L9H4h+JbT/R/WiMMn5bjN43qcLQ6PQX:8R6pHnpcmzn5bjh
MD5:	CCC71F88984A7788C8D01ADD2252D019
SHA1:	6A87752EAC3044792A93599428F31D25DEBEA369
SHA-256:	D69489A723B304E305CB1767E6C8DA5D5D1D237E50F6DDC76E941DCB01684944
SHA-512:	D35CCD639F2C199862E178A9FAB768D7DB10D5A654BC3BC1FAB45D00CEB35A01119A5B4D199E2DB3C3576F512B108F4A1DF7FAF6624D961C0FC4BCA5AF5F0E07
Malicious:	false
Preview:	..........8.h.r...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|. ...}.2.....:.....?.....G.....O.....W.....^.....e.....l.....m.....n.....p.....................................................+.....b.....x.....z.....~.....................................................3.....C.....U.....k.....x.....~................................................................. .....#..........>.....Q.....c.....\|.................................................................(.....3.....?.....f.....s.....................................................1.....4.....D.....T.....c.....x.......................................................................S...................................5.....A.....L.....P.....Z....._.....b.....r...................................3.....M.....R.....Z.....l............... .....".....%.....(..........+.....,.<.....V.../.n...0.{...1.....3.....4.....5.....6.....7.5...8.N...9.a...;.t...<.....=.....>.....?.....@.....A.....C.....D.%.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\fa.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	591476
Entropy (8bit):	5.080621083768775
Encrypted:	false
SSDEEP:	12288:HniDys0XVX9nuyaXTfwIDwNUWGOGfStQvjy1feKtDmrwMTAKzIxRAQiHedNu36Xp:HneM3uyaXTfwewNUWGOGfStQvjy1feKn
MD5:	2E37FD4E23A1707A1ECCEA3264508DFF
SHA1:	E00E58ED06584B19B18E9D28B1D52DBFC36D70F3
SHA-256:	B9EE861E1BDECFFE6A197067905279EA77C180844A793F882C42F2B70541E25E
SHA-512:	7C467F434EB0CE8E4A851761AE9BD7A9E292AAB48E8E653E996F8CA598D0EB5E07EC34E2B23E544F3B38439DC3B8E3F7A0DFD6A8E28169AA95CEFF42BF534366
Malicious:	false
Preview:	........^...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}...........................................................'.....Q.....`.....i..................................."..........R.....u.........................................Q.....y.........................................(...........................................................K.....l.......................,....._.....z..........................................................._.....v.............................K.....g.....v.........................................(.....I.....a.....~.....................................................F........... .....3............................B.....c.....k.....~...................................X.....~.................#.....-.....3.....M.....{......... .....".....%.....(.....*.\...+._...,.}........./.....0.....1.....3.....4._...5.....6.....7.)...8.b...9.{...;.....<.....=.....>.....?.....@.....A.E...C.....D.....E...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\fi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	374471
Entropy (8bit):	5.4357475905490436
Encrypted:	false
SSDEEP:	6144:sMeOXrZx5SkDbhCwx+sk/bOE/BanTLLE5lJucHcEJ18OWUczfSUWcX1wR2:snAr15wRBaA5lJxHcEJ18OWUII2
MD5:	21E534869B90411B4F9EA9120FFB71C8
SHA1:	CC91FFBD19157189E44172392B2752C5F73984C5
SHA-256:	2D337924139FFE77804D2742EDA8E58D4E548E65349F827840368E43D567810B
SHA-512:	3CA3C0ADAF743F92277452B7BD82DB4CF3F347DE5568A20379D8C9364FF122713BEFD547FBD3096505EC293AE6771ADA4CD3DADAC93CC686129B9E5AACF363BD
Malicious:	false
Preview:	........k...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.0...t.9...v.N...w.[...y.a...z.p...\|.v...}...........................................................................................)...../.....8.....U.....\.....l.........................................".....'.....5.....?.....N.....Z........................................................... .....-.....5.....<.....N.....f.....j.....t.....z.........................................7.....A.....F.....N.....U.....a.....n.....{.............................................../.....Q.....Y.....i.....u......................................................................................... .....'.....6.............................b.....t...........................................................(.....D.....f.....}................................................... .....".2...%.^...(.{...*.....+.....,.........../.....0.....1.:...3.H...4.d...5.~...6.....7.....8.....9.....;.0...<.@...=.L...>.b...?.k...@.....A.....C.....D.....E...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\fil.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	419886
Entropy (8bit):	5.213443304857257
Encrypted:	false
SSDEEP:	6144:BnI+f5Qm2xaVyEDQftIK9bSNxeFXGvZ3Omy5GzmHYFAk1s8:C+f541e+b4xy5ym8
MD5:	D7DF2EA381F37D6C92E4F18290C6FFE0
SHA1:	7CACF08455AA7D68259FCBA647EE3D9AE4C7C5E4
SHA-256:	DB4A63FA0D5B2BABA71D4BA0923CAED540099DB6B1D024A0D48C3BE10C9EED5A
SHA-512:	96FC028455F1CEA067B3A3DD99D88A19A271144D73DFF352A3E08B57338E513500925787F33495CD744FE4122DFF2D2EE56E60932FC02E04FEED2EC1E0C3533F
Malicious:	false
Preview:	............h.....i.....j.....k.-...l.8...n.@...o.E...p.R...r.X...s.i...t.r...v.....w.....y.....z.....\|.....}.........................................................................).....6.....K.....a.....h.....q.....................................................'.....D.....J.....[.....q.....{...............................................#.....5.....N.....d...........................................................$.....8.....Q.....v.................................................................,.....7.....W.........................................4.....D.....R.....`.....u...............................................-.....4.....7.....8.....B.....L.....V.....a.....j.....{.................T.....\........................................."...../.....9.....?.....X.....~.............................C.....b.....i.....t..................... .....".....%.....(......5...+.8...,.V.....n.../.....0.....1.....3.....4.....5.....6.I...7._...8.{...9.....;.....<.....=.....>.....?.....@.....A..

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\fr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	436450
Entropy (8bit):	5.4004782148030905
Encrypted:	false
SSDEEP:	12288:LKi1uIt6QuagV1ZzosmZ7MYnYV1S3Bb5MxlqE0wC5wZLljHnkH0oR5FEu64JGV7h:qVVQ515CF
MD5:	3EE48A860ECF45BAFA63C9284DFD63E2
SHA1:	1CB51D14964F4DCED8DEA883BF9C4B84A78F8EB6
SHA-256:	1923E0EDF1EF6935A4A718E3E2FC9A0A541EA0B4F3B27553802308F9FD4FC807
SHA-512:	EB6105FACA13C191FEF0C51C651A406B1DA66326BB5705615770135D834E58DEE9BED82AA36F2DFB0FE020E695C192C224EC76BB5C21A1C716E5F26DFE02F763
Malicious:	false
Preview:	.........._.h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...r.{...s.....t.....v.....w.....y.....z.....\|.....}............................................................. .....".....G.....W.....e.....w...........................................................+.....>.....\.....c.....q.........................................#.....?.....A.....T.....h.....t...........................................................+.....=.....N.....r...........................................................(.....G.....O....._.........................................H.....Z.....d.....q.....................................................!.....(.....+.....,.....4.....<.....E.....L....._.................#..........j...........................................................#.....H.....d.......................2.....I.....P.....Y.....j............... .....".....%.....(..........+.....,.-.....D.../.i...0.w...1.....3.....4.....5.....6.Q...7.b...8.z...9.....;.....<.....=.....>.....?.....@.....A.G...C.n...D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\gu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	832533
Entropy (8bit):	4.370164270379204
Encrypted:	false
SSDEEP:	3072:RqlNvTn1Pdm06M0ITsKMaWZKerbtsMhmksd4Mqz2sQmB51jvjsWnhAgfZw/g/I/f:RuN7n1VQFLFwsL5cqhgrA8
MD5:	308619D65B677D99F48B74CCFE060567
SHA1:	9F834DF93FD48F4FB4CA30C4058E23288CF7D35E
SHA-256:	E40EE4F24839F9E20B48D057BF3216BC58542C2E27CB40B9D2F3F8A1EA5BFBB4
SHA-512:	3CA84AD71F00B9F7CC61F3906C51B263F18453FCE11EC6C7F9EDFE2C7D215E3550C336E892BD240A68A6815AF599CC20D60203294F14ADB133145CA01FE4608F
Malicious:	false
Preview:	..........T.h.:...i.T...j.`...k.o...l.z...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}......................... .....(...../.....6.....=.....>.....?.....D.......................0.....E.....[.......................+.....c.....e.....q.......................8.....p...................................Q...................................<.....X.................%.....>.....c........................................U.......................w...............................................g.....v.......................Q.................D.............................%.....O.....R.....r.............................+.....2.....5.....7.....P.....i.......................H...........\.....~...........S.................%.....E.....N.....o.....{.......................O.................;............................M.....o......... .....".....%.....(.Y...*.....+.....,.........../.1...0.Y...1.....3.....4.....5.;...6.....7.....8.,...9.T...;.....<.....=.....>.....?.....@.0...A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\he.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	519468
Entropy (8bit):	4.6902065244805256
Encrypted:	false
SSDEEP:	12288:iDIJk5rUp/mTLa2/ANNqOL607Af6XVjeQCapb1527oFpMbe54lmdADnwg5Qgx:7205KoM
MD5:	FC84EA7DC7B9408D1EEA11BEEB72B296
SHA1:	DE9118194952C2D9F614F8E0868FB273DDFAC255
SHA-256:	15951767DAFA7BDBEDAC803D842686820DE9C6DF478416F34C476209B19D2D8C
SHA-512:	49D13976DDDB6A58C6FDCD9588E243D705D99DC1325C1D9E411A1D68D8EE47314DFCB661D36E2C4963C249A1542F95715F658427810AFCABDF9253AA27EB3B24
Malicious:	false
Preview:	........\|.\|.h.....i.....j.....k.....l.!...n.)...o.....p.;...r.A...s.R...t.[...v.p...w.}...y.....z.....\|.....}.........................................................................8.....O.....h............................................... .....".....&.....N.....j.........................................B.....[.....p...............................................G.....o.....w...............................................).....E.....y.............................$.....,.....3.....?.....V.....r...................................!.....D.....h...................................7.....W.....Z.....m............................................................................./.................e.....o.......................E.....X.....p.....v.........................................@.....Z...................................#.....J.....U... .g...".....%.....(.....*.....+.....,.......#.../.C...0.P...1.....3.....4.....5.....6.9...7.R...8.g...9.{...;.....<.....=.....>.....?.....@.....A.x...C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\hi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	868673
Entropy (8bit):	4.359937106090665
Encrypted:	false
SSDEEP:	3072:FugBVdK+X9c+XdfdkhSvf4QAEm5dmGrsUt3GR3GXO7NLdYnLsBPtv83ctKOf4z8d:cuVAsc+NZB5/5MNSD
MD5:	B5DFCE8E3BA0AEC2721CC1692B0AD698
SHA1:	C5D6FA21A9BA3D526F3E998E3F627AFB8D1EECF3
SHA-256:	B1C7FB6909C8A416B513D6DE21EEA0B5A6B13C7F0A94CABD0D9154B5834A5E8B
SHA-512:	FACF0A9B81AF6BB35D0FC5E69809D5C986A2C91A166E507784BDAD115644B96697FE504B8D70D9BBB06F0C558F746C085D37E385EEF41F0A1C29729D3D97980F
Malicious:	false
Preview:	........y...h.....i.....j.....k.....l.....n.#...o.(...p.5...r.;...s.L...t.U...v.j...w.w...y.}...z.....\|.....}.........................................................................t...................................A.....d.....~.............................4.....c...................................d.......................l...................................J........... .....9.....H.....p...................................P.......................g.........................................+.....K.......................P.....u.......................l.......................9.....b...................................C.....m...............................................#.....D.................&.....<.................N.................................../.....A.....s................................................................R.....q... .....".....%.....(.6....s...+.v...,.........../.....0.5...1.....3.....4.....5.@...6.....7.....8.:...9._...;.....<.....=.....>.....?.....@.8...A.\|...C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\hr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	406671
Entropy (8bit):	5.521226257186607
Encrypted:	false
SSDEEP:	3072:z9mYpq0ZkIEZgVRTJ3MOS+WG0uPXbG4TT6WI6DkYAiKbeM/wXbnWNjdmvW0IEifp:zTEgNmW/5tE7IDjG
MD5:	255F808210DBF995446D10FF436E0946
SHA1:	1785D3293595F0B13648FB28AEC6936C48EA3111
SHA-256:	4DF972B7F6D81AA7BDC39E2441310A37F746AE5015146B4E434A878D1244375B
SHA-512:	8B1A4D487B0782055717B718D58CD21E815B874E2686CDFD2087876B70AE75F9182F783C70BF747CF4CA17A3AFC68517A9DB4C99449FA09BEF658B5E68087F2A
Malicious:	false
Preview:	..........<.h.j...i.{...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}......2.....7.....?.....G.....O.....V.....].....d.....e.....f.....h...........................................................:.....K.....M.....Q.....y...........................................................-.....D.....T.....Z.....b.....p.......................................................................&.....8.....H.....].....z...........................................................&.....1.....H.....................................................'.....2.....F.....g.....j.....z...................................................................................`.......................;.....W.....p.....................................................6.....N............................................... .....B.....M... .W...".h...%.....(..........+.....,.........../.....0.....1.O...3.a...4.~...5.....6.....7.....8.....9.0...;.>...<.K...=.W...>.l...?.u...@.....A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\hu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	437458
Entropy (8bit):	5.655020135928055
Encrypted:	false
SSDEEP:	6144:wxEAuskhSSfm4Cky1tV5z8iZfGRzEY63aQSam7gXOeeeQi5gR7azQtGV52n5ydpS:wxLaj6V5z850+7BwQi5Rn6Z
MD5:	2AA0A175DF21583A68176742400C6508
SHA1:	3C25BA31C2B698E0C88E7D01B2CC241F0916E79A
SHA-256:	B59F932DF822AB1A87E8AAB4BBB7C549DB15899F259F4C50AE28F8D8C7CE1E72
SHA-512:	03A16FEB0601407E96BCB43AF9BDB21E5218C2700C9F3CFD5F9690D0B4528F9DC17E4CC690D8C9132D4E0B26D7FAAFD90AA3F5E57237E06FB81AAB7AB77F6C03
Malicious:	false
Preview:	..........j.h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...r.c...s.t...t.}...v.....w.....y.....z.....\|.....}.........................................................................L.....\.....r...............................................,...........2.....Z.....y.....................................................-.....X.....p.....u.....{.........................................!.....9.....X.....\....._.....m...................................@.....c.................................................................7.....B.....Z.....h.....................................................,.....A.....[.....{.................................................................q...........5.....;...................................#.....+.....9.....A.....G.....^.............................>.....u....................................... .....".....%.5...(.R...*.x...+.{...,.........../.....0.....1.....3.....4.6...5.X...6.....7.....8.....9.....;.....<.....=.....>.(...?.5...@.H...A.p...C.....D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\id.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	359190
Entropy (8bit):	5.384547702191974
Encrypted:	false
SSDEEP:	6144:UINLZJl/dv1DR9S2fjDVnjHFfRmP2x1r856Rh1vtTtSLsEar:Nf7PDuAVnjHFpm+xh856RhP
MD5:	B6FCD5160A3A1AE1F65B0540347A13F2
SHA1:	4CF37346318EFB67908BBA7380DBAD30229C4D3D
SHA-256:	7FD715914E3B0CF2048D4429F3236E0660D5BD5E61623C8FEF9B8E474C2AC313
SHA-512:	A8B4A96E8F9A528B2DF3BD1251B72AB14FECCF491DD254A7C6ECBA831DFABA328ADB0FD0B4ACDDB89584F58F94B123E97CAA420F9D7B34131CC51BDBDBF3ED73
Malicious:	false
Preview:	.........._.h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...r.{...s.....t.....v.....w.....y.....z.....\|.....}............................................................. .....".....E.....S.....`.....p.....w.................................................................3.....;.....I.....Y.....a.....n.................................................................;.....P.....W.....^.....p.....}...........................................................0.....>.....C.....K.....R.....W.....a.....l...............................................$.....R.....x.................................................................'.....8.....?.....B.....C.....K.....S.....[.....c.....i.....u.............................@.....Q.....a.................................................................%.....:.....T............................................. .....".....%.....(.+...*.D...+.G...,.e.....u.../.....0.....1.....3.....4.....5.....6.5...7.H...8.\...9.i...;.w...<.....=.....>.....?.....@.....A...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\it.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	397402
Entropy (8bit):	5.301296912236702
Encrypted:	false
SSDEEP:	6144:n9BKi2azctogSrqRrhsO11GT9TeLAG3XRU2gY7OfLwH+WcMgB8HryeuRNBPJX9SO:n9FTnzZY28+2vx+0e55zoI
MD5:	745F16CA860EE751F70517C299C4AB0E
SHA1:	54D933AD839C961DD63A47C92A5B935EEF208119
SHA-256:	10E65F42CE01BA19EBF4B074E8B2456213234482EADF443DFAD6105FAF6CDE4C
SHA-512:	238343D6C80B82AE900F5ABF4347E542C9EA016D75FB787B93E41E3C9C471AB33F6B4584387E5EE76950424E25486DD74B9901E7F72876960C0916C8B9CEE9A6
Malicious:	false
Preview:	..........Q.h.@...i.Q...j.]...k.l...l.w...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................%.....,.....3.....:.....;.....<.....>.....i.....\|.......................................................................C.....V.....w.....~................................................................C.....Y.....o.................................................................0.....D.....f......................................................................2.....@.....v............................................... .....,.....?.....T.....W.....k...................................................................................b.......................:.....O.....d.................................................................K.....k................................................... .....".$...%.H...(.`...*.\|...+.....,.........../.....0.....1.....3.(...4.H...5.f...6.....7.....8.....9.....;.....<.....=. ...>.K...?.V...@.g...A.....C.....D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\ja.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	484003
Entropy (8bit):	5.752575429591325
Encrypted:	false
SSDEEP:	3072:fznG4qRo+yixrD1r04XURrRpZd2hy/NPNQPkwRI6dIKhUNH7bbeCsy5SWbaabF/G:fzGBRo+911WlRpZd2yNp6k5AYxVk
MD5:	38CD3EF9B7DFF9EFBBE086FA39541333
SHA1:	321EF69A298D2F9830C14140B0B3B0B50BD95CB0
SHA-256:	D8FAB5714DAFECB89B3E5FCE4C4D75D2B72893E685E148E9B60F7C096E5B3337
SHA-512:	40785871032B222A758F29E0C6EC696FBE0F6F5F3274CC80085961621BEC68D7E0FB47C764649C4DD0C27C6EE02460407775FAE9D3A2A8A59362D25A39266CE0
Malicious:	false
Preview:	............h.....i.....j.....k.....l.....m.....o.1...p.>...v.D...w.Q...y.W...z.f...\|.l...}.~.........................................................................................3.....Q.....r.....x.............................(.....I.....K.....O.....w.........................................#.....J.....Z.....u..............................................._...........................................................9.....c.......................#.....3.....<.....D.....K.....T.....i.....y.............................B.....c................................... .....D.....G.....V.....q.....................................................$.....1.....D.................z.......................&.....Y.....h.....................................................7.....O...................................#.....C.....I... .R...".d...%.....(.....*.....+.....,.......J.../.h...0.q...1.....3.....4.....5.....6.g...7.....8.....9.....;.....<.....=.....>.:...?.D...@.Y...A.....C.....D.....E.....F.0...G.Z.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\kn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	960888
Entropy (8bit):	4.2704203524429865
Encrypted:	false
SSDEEP:	12288:P8nyRnHoS7yB/rt2o6i7u7b5frUb+7G+Vma:ti6X5jUA
MD5:	CAAB4DEB1C40507848F9610D849834CF
SHA1:	1BC87FF70817BA1E1FDD1B5CB961213418680CBE
SHA-256:	7A34483E6272F9B8881F0F5A725B477540166561C75B9E7AB627815D4BE1A8A4
SHA-512:	DC4B63E5A037479BB831B0771AEC0FE6EB016723BCD920B41AB87EF11505626632877073CE4E5E0755510FE19BA134A7B5899332ECEF854008B15639F915860C
Malicious:	false
Preview:	..........7.h.t...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....u...........>.....u.......................F.....g.....y...........<.....>.....J.....r.......................^.......................e.................1.....n.....................................................1.....l.....{.....~.................,.....l............................-.....E.....M.....T.....f.............................I.......................S.................d.............................`.....c.......................E...............................................#.....6.....`.................".....=.................(...............................................@.............................".......................(.....h............... ....."."...%.....(..........+.....,.;.....l.../.....0.....1.U...3.o...4.....5.....6.....7.....8.....9.V...;.....<.....=.....>.....?.....@.G...A.....C.....D.=.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\ko.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	407632
Entropy (8bit):	6.124197697056213
Encrypted:	false
SSDEEP:	12288:Md9PhJeKVoCGet8Oh2J7klCqZ5T7BKI8LtCq7hUoqAX:Md91UJc5184AX
MD5:	D6194FC52E962534B360558061DE2A25
SHA1:	98ED833F8C4BEAC685E55317C452249579610FF8
SHA-256:	1A5884BD6665B2F404B7328DE013522EE7C41130E57A53038FC991EC38290D21
SHA-512:	5207A07426C6CEB78F0504613B6D2B8DADF9F31378E67A61091F16D72287ADBC7768D1B7F2A923369197E732426D15A872C091CF88680686581D48A7F94988AB
Malicious:	false
Preview:	............h.....i.....j.....k.....l.....m.....o.....p.....r.....s.-...t.6...y.K...z.Z...\|.`...}.r.....z.........................................................................................7.....D.....^.....k.....s.........................................3.....?.....L.....\.....c.....}.................................................................d.....z.................................................................%.....F.....j.......................................................................`.....v..................................6.....L.....Y.....n.........................................................................................x...........D.....M.............................#.....6.....9.....L.....R.....[.....r...................................^.....n.....w.....}..................... .....".....%.....(......M...+.P...,.........../.....0.....1.....3.....4.5...5.]...6.....7.....8.....9.....;.....<.....=.....>.....?./...@.C...A.q...C.....D.....E.....F.....G...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\lt.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	439793
Entropy (8bit):	5.6365541871793114
Encrypted:	false
SSDEEP:	6144:zXtEPi5jFX4VU4EzsnHIOBoU+1Qi7t5GkzvLdyaj+teJvxY2I96Su:CEmguHLBoUnU5TzvLWeJJG6Su
MD5:	64B08FFC40A605FE74ECC24C3024EE3B
SHA1:	516296E8A3114DDBF77601A11FAF4326A47975AB
SHA-256:	8A5D6E29833374E0F74FD7070C1B20856CB6B42ED30D18A5F17E6C2E4A8D783E
SHA-512:	05D207413186AC2B87A59681EFE4FDF9DC600D0F3E8327E7B9802A42306D80D0DDD9EE07D103B17CAF0518E42AB25B7CA9DA4713941ABC7BCED65961671164AC
Malicious:	false
Preview:	..........S.h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....:.....h.....v...............................................&.....7.....9.....=.....e.....................................................(.....7.....Q.....f.....m.....v.....................................................6.....A.....L.....V.....l............................. .....G.....e.....n.....v.....}...............................................).....4.....K.....]................................................................./.....G.....^.....x...........................................................Y....................... .....A.....w....................................................>.....r...............................................L.....Y... .n...".~...%.....(..........+.....,.......6.../.Q...0.T...1.....3.....4.....5.....6.-...7.P...8.p...9.....;.....<.....=.....>.....?.....@.....A.I...C.j.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\lv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	437670
Entropy (8bit):	5.638618522703661
Encrypted:	false
SSDEEP:	6144:TjewdtAe6tN4tVFHzmstt4Uoo3W3sb3F5hZanXnEv9AhraszLOAty6ls1V:RR/v4UVWwF5UEabns1V
MD5:	A8CBD741A764F40B16AFEA275F240E7E
SHA1:	317D30BBAD8FD0C30DE383998EA5BE4EEC0BB246
SHA-256:	A1A9D84FD3AF571A57BE8B1A9189D40B836808998E00EC9BD15557B83D0E3086
SHA-512:	3DA91C0CA20165445A2D283DB7DC749FCF73E049BFFF346B1D79B03391AEFC7F1310D3AC2C42109044CFB50AFCF178DCF3A34B4823626228E591F328DD7AFE95
Malicious:	false
Preview:	..........C.h.\...i.m...j.y...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......$.....).....1.....9.....A.....H.....O.....V.....W.....X.....Z...........................................................3.....O.....Q.....U.....}...........................................................7.....Q.....b.....h.....n.....................................................,.....5.....8.....?.....U.....g.....y...........................................................'.....@.....c.....g.........................................9.....[.....l...........................................................1.....H.....O.....R.....S.....].....h.....p.....w.......................].....h.......................8.....C.....U.....\.....k.....n.....y...................................S............................................. .....".....%.'...(.A...*.^...+.a...,.........../.....0.....1.....3.....4.,...5.Q...6.....7.....8.....9.....<.....=.....>.....?.....@.....A.i...C.....D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\ml.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	998155
Entropy (8bit):	4.3110320925732095
Encrypted:	false
SSDEEP:	12288:T6ALnHOE47/URV1BQMmWDcZubSAD7qcDs3eThx5D/7dZdO3cb:9Owoys3eT5D/79O3u
MD5:	1C81104AC2CBF7F7739AF62EB77D20D5
SHA1:	0F0D564F1860302F171356EA35B3A6306C051C10
SHA-256:	66005BC01175A4F6560D1E9768DBC72B46A4198F8E435250C8EBC232D2DAC108
SHA-512:	969294EAE8C95A1126803A35B8D3F1FC3C9D22350AA9CC76B2323B77AD7E84395D6D83B89DEB64565783405D6F7EAE40DEF7BDAF0D08DA67845AE9C7DBB26926
Malicious:	false
Preview:	..........:.h.n...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......6.....;.....C.....K.....S.....Z.....a.....h.....i.....j.....o.................Z.......................1.....O.................k.....m.....q.......................E.............................x.................Y.............................+....._...........6.....T.....{.............................5.......................u...........,.........................................#.....K...............................................:...........,.....f.............................".....f.......................O.....................................................i................._.....}.......................`.........................................s...........T...........&...........l.......................H.....s......... .....".....%.....(.....*.T...+.W...,.........../.....0.....1.....3.....4.....5.v...6.....7.R...8.....9.....;.S...<.p...=.....>.....?.....@.....A.U...C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\mr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	816652
Entropy (8bit):	4.350418506868822
Encrypted:	false
SSDEEP:	3072:ZE7bv9/9xAvtACKjxUp0djbOXspvibMFFPMUh3RQR3KB+5lx14/H4bmHwMaZ0t4k:ZE7b1fOACsxZjAEV6yZ00VbJ5JgezP5
MD5:	2CF9F07DDF7A3A70A48E8B524A5AED43
SHA1:	974C1A01F651092F78D2D20553C3462267DDF4E9
SHA-256:	23058C0F71D9E40F927775D980524D866F70322E0EF215AA5748C239707451E7
SHA-512:	0B21570DEEFA41DEFC3C25C57B3171635BCB5593761D48A8116888CE8BE34C1499FF79C7A3EBBE13B5A565C90027D294C6835E92E6254D582A86750640FE90F2
Malicious:	false
Preview:	........\|.\|.h.....i.....j.....k.....l....n.2...o.7...p.D...r.J...s.[...t.d...v.y...w.....y.....z.....\|.....}.........................................................................q...................................5.....G.....Y.............................<.....a.......................,.....B.....w.......................^.....}.................................................................D.....M.....P.....l.......................A.......................<.....O.....W.....^.....j.............................2.............................J.......................P.....s...................................-.....N.....r.....................................................2...........b...................................K.....d.........................................@.................,.....m.......................:.....]............... .....".....%.J...(..........+.....,.......!.../.]...0.j...1.....3.....4.4...5.n...6.....7.....8.X...9.....;.....<.....=.....>.%...?.8...@.g...A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\ms.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	374453
Entropy (8bit):	5.272284824619555
Encrypted:	false
SSDEEP:	6144:DZ/AO2kUDrt2MBrIxFQJulcul5WkS/PSOW5soNY3MMyvek:DZ/ApkUDrt2MOxSIl51kP05RYcMA
MD5:	AEE105366A1870B9D10F0F897E9295DB
SHA1:	EEE9D789A8EEAFE593CE77A7C554F92A26A2296F
SHA-256:	C6471AEE5F34F31477D57F593B09CB1DE87F5FD0F9B5E63D8BAB4986CF10D939
SHA-512:	240688A0054BFEBE36EA2B056194EE07E87BBBEB7E385131C73A64AA7967984610FCB80638DD883837014F9BC920037069D0655E3E92A5922F76813AEDB185FA
Malicious:	false
Preview:	..........8.h.r...i.z...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.).....1.....6.....>.....F.....N.....U.....\.....c.....d.....e.....j...........................................................A.....X.....Z.....^...........................................................+.....9.....M.....Z.....a.....f.....u............................................................................9.....M.....d.......................................................................$.....6.....d.....x.....................................................).....=.....@.....T.....h.....z...................................................................................e...................................$...../.....A.....L.....V.....^.....e.....\|...................................1.....F.....L.....R.....a.....v......... .....".....%.....(..........+.....,.......$.../.:...0.D...1.x...3.....4.....5.....6.....7.....8.&...9.9...;.M...<.X...=.i...>.....?.....@.....A...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\nb.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	367614
Entropy (8bit):	5.435724855090923
Encrypted:	false
SSDEEP:	6144:TAJxNH0uqnIhgFYMqOp7fwcbgtmX07Sgzuu5Dn4XYnOGrr:ExdfqnPFYMqOp7fwcwSgB5Dn4LGrr
MD5:	55D5AD4EACB12824CFCD89470664C856
SHA1:	F893C00D8D4FDB2F3E7A74A8BE823E5E8F0CD673
SHA-256:	4F44789A2C38EDC396A31ABA5CC09D20FB84CD1E06F70C49F0664289C33CD261
SHA-512:	555D87BE8C97F466C6B3E7B23EC0210335846398C33DBA71E926FF7E26901A3908DBB0F639C93DB2D090C9D8BDA48EDDF196B1A09794D0E396B2C02B4720F37E
Malicious:	false
Preview:	..........P.h.B...i.Y...j.e...k.t...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................%.....-.....4.....;.....B.....C.....D.....F.....m.....x.................................................................".....J.....^.....v.....{.....................................................)...../.....5.....D.....T.....c.......................................................................-.....J.....c.....{.......................................................................+.....6.....@.....Y.....o.......................................................................%.....5.....I.....P.....S.....T.....[.....c.....n.....u..................................x...........................................................,.....I.....`.....y...............................................'.....2... .7...".@...%.Z...(.z........+.....,.........../.....0.....1.....3. ...4.:...5.O...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.....A.?...C.\.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\nl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	379453
Entropy (8bit):	5.379227569652463
Encrypted:	false
SSDEEP:	6144:KcJ9Smne7gqDO5EQHzpamU3D+qn7Cv5qPxOGpLMsLPW:Km9nCgqDO5ELrOv5qPxOGpLM+PW
MD5:	0F04BAC280035FAB018F634BCB5F53AE
SHA1:	4CAD76EAECD924B12013E98C3A0E99B192BE8936
SHA-256:	BE254BCDA4DBE167CB2E57402A4A0A814D591807C675302D2CE286013B40799B
SHA-512:	1256A6ACAC5A42621CB59EB3DA42DDEEACFE290F6AE4A92D00EBD4450A8B7CCB6F0CD5C21CF0F18FE4D43D0D7AEE87B6991FEF154908792930295A3871FA53DF
Malicious:	false
Preview:	..........Y.h.0...i.A...j.M...k.\...l.g...n.o...o.t...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................#..........+.....,...........\.....h.....x.................................................................).....A.....].....k.....{...............................................)...........7.....F.....V.....e.................................................................3.....K.....o.................................................................).....0.....E.....}.........................................'.....1.....?.....^.....a.....v.............................................................................).....k.......................+.....@.....X.................................................................3.....H.....f............................................. .....".....%.....(.+....D...+.G...,.e.....v.../.....0.....1.....3.....4.....5.....6.J...7.b...8.....9.....;.....<.....=.....>.....?.....@.....A.....C.8...D.B.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\pl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	422325
Entropy (8bit):	5.774687126444438
Encrypted:	false
SSDEEP:	12288:roj98jy/jojSoM/Z+Xgv3iWhbhvPeCUdxUwVTmNF1Qhjhd5UR405Y:ryMV+1Qhb5IY
MD5:	F1D48A7DCD4880A27E39B7561B6EB0AB
SHA1:	353C3BA213CD2E1F7423C6BA857A8D8BE40D8302
SHA-256:	2593C8B59849FBC690CBD513F06685EA3292CD0187FCF6B9069CBF3C9B0E8A85
SHA-512:	132DA2D3C1A4DAD5CCB399B107D7B6D9203A4B264EF8A65ADD11C5E8C75859115443E1C65ECE2E690C046A82687829F54EC855F99D4843F859AB1DD7C71F35A5
Malicious:	false
Preview:	..........R.h.>...i.O...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....:.....j.....y.....................................................!.....#.....'.....O.....g......................................................................0.....6.....I.....].....o.............................................................................J.....f.............................................................................K....._.....j.....................................................<.....?.....N.....\.....k.......................................................................9.......................(.....E.....`.....................................................#.....=.....k...............................................9.....D... .M...".]...%.....(..........+.....,.........../.....0."...1.Q...3.`...4.....5.....6.....7.....8.....9.....;.&...<.1...=.;...>.O...?.X...@.k...A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\pt-BR.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	399250
Entropy (8bit):	5.432001310431886
Encrypted:	false
SSDEEP:	6144:oNssFqCoNBXBL3sNA65VyS15LqJVlLUoR1peV:oNssFqIF5uJH4oR/g
MD5:	8E931FFBDED8933891FB27D2CCA7F37D
SHA1:	AB0A49B86079D3E0EB9B684CA36EB98D1D1FD473
SHA-256:	6632BD12F04A5385012B5CDEBE8C0DAD4A06750DC91C974264D8FE60E8B6951D
SHA-512:	CF0F6485A65C13CF5DDD6457D34CDEA222708B0BB5CA57034ED2C4900FD22765385547AF2E2391E78F02DCF00B7A2B3AC42A3509DD4237581CFB87B8F389E48D
Malicious:	false
Preview:	..........=.h.h...i.y...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....i...........................................................@.....U.....W.....[...........................................................'.....A.....a.....x...............................................!.....,.....<.....I.....M.....P.....W.....l.....z.....................................................&.....,.....7.....E.....].....g.....x...................................4.....>.....N.....[.....m...................................................................................%.....,.....<.....o.......................&.....;.....R.....z.................................................................G.....e............................................. .....".....%.)...(.?...*.Z...+.]...,.{........./.....0.....1.....3.....4.....5.'...6._...7.s...8.....9.....;.....<.....=.....>.....?.....@.....A.0...C.S...D.].

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\pt-PT.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	400379
Entropy (8bit):	5.412017917472705
Encrypted:	false
SSDEEP:	6144:dqPhA4zslBWfIw2ieJVJJxhmOcXLFIUK5IKM4RV6X:EJolB/2bfK5IKM4RG
MD5:	B4954B064E3F6A9BA546DDA5FA625927
SHA1:	584686C6026518932991F7DE611E2266D8523F9D
SHA-256:	EE1E014550B85E3D18FB5128984A713D9F6DE2258001B50DDD18391E7307B4A1
SHA-512:	CB3B465B311F83B972ECA1C66862B2C5D6EA6AC15282E0094AEA455123DDF32E85DF24A94A0AEDBE1B925FF3ED005BA1E00D5EE820676D7A5A366153ADE90EF7
Malicious:	false
Preview:	..........2.h.~...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.&...\|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z.....................................................!.....).....J.....\.....^.....b...........................................................).....<.....W.....o.....y.....................................................'.....4.....8.....;.....B.....[.....i.....z...............................................$..........5.....C.....Y.....a.....r.........................................6.....A.....Q.....^.....p.............................................................................%...........5.....F.............................>.....R.....f...........................................................(.....U.....q............................................... ... .$...".8...%.S...(.i........+.....,.........../.....0.....1.....3.&...4.J...5.n...6.....7.....8.....9.....;.....<.....=.....>.A...?.L...@.a...A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\ro.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	412797
Entropy (8bit):	5.469387509353947
Encrypted:	false
SSDEEP:	6144:Lsg4/xnSFcFG1Y6vFEsif5QB0o1s21/oulzr:Lt7FcFG1Y6vesif5QKob/dr
MD5:	D2758F6ADBAEEA7CD5D95F4AD6DDE954
SHA1:	D7476DB23D8B0E11BBABF6A59FDE7609586BDC8A
SHA-256:	2B7906F33BFBE8E9968BCD65366E2E996CDF2F3E1A1FC56AD54BAF261C66954C
SHA-512:	8378032D6FEBEA8B5047ADA667CB19E6A41F890CB36305ACC2500662B4377CAEF3DC50987C925E05F21C12E32C3920188A58EE59D687266D70B8BFB1B0169A6E
Malicious:	false
Preview:	..........Z.h.....i.?...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................&.....'.....(..........e.....t.......................................................................2.....S.....p.....y...............................................-.....D.....L....._.....s...............................................2.....=.....E.....b...................................>.....O.....W....._.....f.....l.....{...............................................+.....;.....b...........................................................'.....B.....`.....t.....{.....~...............................................].............................2.....b.....m.....................................................?.....g.........................................#...../... .9...".M...%.p...(..........+.....,.........../.....0.....1.....3.?...4.[...5.{...6.....7.....8.....9.....;.....<.....=.(...>.C...?.K...@.Z...A.....C.....D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\ru.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	672991
Entropy (8bit):	4.887128747074479
Encrypted:	false
SSDEEP:	12288:xkFzEroY5eXN2hHO3j/jHXzvMBJJWkKce8P/XzFGGJn/aZ/LNUFC0WGWajfG1UpM:xUQMi5y6d4
MD5:	2885BDE990EE3B30F2C54A4067421B68
SHA1:	AE16C4D534B120FDD68D33C091A0EC89FD58793F
SHA-256:	9FCDA0D1FAB7FFF7E2F27980DE8D94FF31E14287F58BD5D35929DE5DD9CBCDCA
SHA-512:	F7781F5C07FBF128399B88245F35055964FF0CDE1CC6B35563ABC64F520971CE9916827097CA18855B46EC6397639F5416A6E8386A9390AFBA4332D47D21693F
Malicious:	false
Preview:	............h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................".....#.....$.....&.....~...................................4.....>.....H.........................................-.....9.....X.....l...................................T.....w.............................E.....o.....y...............................................$.....?.....\|.......................).....7.....?.....M.....n...................................H.....X.......................#.....D.....W.....{...................................<.....^...........................................................r.............................@.....g.............................).....>.....L.....z.................`.....~...........$.....U.....g.....{..................... .....".....%.,...(.r...*.....+.....,.........../.:...0.K...1.....3.....4.....5."...6.....7.....8.....9.....;.....<.1...=.E...>.\|...?.....@.....A.-...C.e...D.v...E.....F...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\sk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	426178
Entropy (8bit):	5.821396103086126
Encrypted:	false
SSDEEP:	6144:M43lA0ct/muNypigJ4BOn5aHSL9aQCqoLWGL:91cgsypipBI5aHSL9aQCDLd
MD5:	B7E97CC98B104053E5F1D6A671C703B7
SHA1:	0F7293F1744AE2CD858EB3431EE016641478AE7D
SHA-256:	B0D38869275D9D295E42B0B90D0177E0CA56A393874E4BB454439B8CE25D686F
SHA-512:	EF3247C6F0F4065A4B68DB6BF7E28C8101A9C6C791B3F771ED67B5B70F2C9689CEC67A1C864F423382C076E4CBB6019C1C0CB9AD0204454E28F749A69B6B0DE0
Malicious:	false
Preview:	..........R.h.>...i.R...j.^...k.m...l.x...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................&.....-.....4.....;.....<.....=.....?.....s.....................................................(.....=.....?.....C.....k.....................................................'.....7.....S.....b.....h.....p...........................................................-.....8.....V.....l.....~...........................................................#.....2.....I.....T.....o...................................8.....B.....P.....\.....k.............................................................................'...../.....;.....K.................?.....F.............................+.....F.....K.....W.....b.....k...................................N............................................. .....".....%.,...(.G...*.h...+.k...,.........../.....0.....1.....3.....4. ...5.?...6.v...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.Z...C.{...D.....E...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\sl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	411437
Entropy (8bit):	5.49350335324308
Encrypted:	false
SSDEEP:	6144:tnerKYjnS4fhmi0i2iiBnnbANjbnPMum4ocyxPbPD/yu0zrVftjQLc35BdFPcNpU:lEjnSn1iHd35vtcqO+i/fz50qg
MD5:	CA763E801DE642E4D68510900FF6FABB
SHA1:	C32A871831CE486514F621B3AB09387548EE1CFF
SHA-256:	340E0BABE5FDDBFDA601C747127251CF111DD7D79D0D6A5EC4E8443B835027DE
SHA-512:	E2847CE75DE57DEB05528DD9557047EDCD15D86BF40A911EB97E988A8FDBDA1CD0E0A81320EADF510C91C826499A897C770C007DE936927DF7A1CC82FA262039
Malicious:	false
Preview:	..........c.h.....i.-...j.7...k.F...l.Q...n.Y...o.^...p.k...r.q...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................B.....T.....b.....r.....z.....................................................F.....d.....\|.......................................................................%.....4.....H.....W.......................................................................#.....=.....].....{.....................................................#...........>.....k.....u...............................................'.....6.....P.....U.....e.....x.............................................................................E.......................&.....I.....j.....................................................%.....=.....j...............................................&.....2... .<...".N...%.f...(.....*.....+.....,.........../.....0.....1.I...3.X...4.t...5.....6.....7.....8.....9.....;.#...<./...=.9...>.L...?.V...@.d...A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\sr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	630964
Entropy (8bit):	4.810757945626649
Encrypted:	false
SSDEEP:	12288:H0JfhK5lIRIS151RHexYzs+DN5W9xTvvWF37sQ/k/k/i:y5V9dN5Oxjn
MD5:	C68C235D8E696C098CF66191E648196B
SHA1:	5C967FBBD90403A755D6C4B2411E359884DC8317
SHA-256:	AB96A18177AF90495E2E3C96292638A775AA75C1D210CA6A6C18FBC284CD815B
SHA-512:	34D14D8CB851DF1EA8CD3CC7E9690EAF965D8941CFCAC1C946606115AD889630156C5FF47011B27C1288F8DF70E8A7DC41909A9FA98D75B691742EC1D1A5E653
Malicious:	false
Preview:	..........?.h.d...i.u...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.$.....,.....1.....9.....A.....I.....P.....W.....^....._.....`.....b.......................#.....=.....X.............................I.....K.....O.....w...................................(.....B.....w.........................................B.....k.............................+.....D....._.....i.....y...................................Q...............................................&.....H.....l.....x.............................B.....e............................./.....O.........................................(.....H.....O.....R.....S.....].....i.......................5...........Q.....a...........1.....^................................... ..........N.......................O............................. .....5.....h.....}... .....".....%.....(.%....W...+.Z...,.x........./.....0.....1.4...3.K...4.....5.....6.$...7.L...8.z...9.....;.....<.....=.....>.!...?.2...@.S...A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\sv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	370331
Entropy (8bit):	5.550902354924257
Encrypted:	false
SSDEEP:	6144:A3J7MHJrRRcAjowQx+ByxN6dn4bLXvu9M7SOVDE/xUDv6o5WI5ggbN:G7EHl9BdU5X5x
MD5:	272F8A8B517C7283EAB83BA6993EEA63
SHA1:	AD4175331B948BD4F1F323A4938863472D9B700C
SHA-256:	D15B46BC9B5E31449B11251DF19CD2BA4920C759BD6D4FA8CA93FD3361FDD968
SHA-512:	3A0930B7F228A779F727EBFB6AE8820AB5CC2C9E04C986BCE7B0F49F9BF124F349248ECDF108EDF8870F96B06D58DEA93A3E0E2F2DA90537632F2109E1AA65F0
Malicious:	false
Preview:	..........q.h.....i.....j.....k.,...l.7...n.?...o.D...p.Q...r.W...s.h...t.q...v.....w.....y.....z.....\|.....}.........................................................................(.....9.....K....._.....g.....p.....................................................%.....=.....C.....S.....d.....k.....x.................................................................W.....m.....y.................................................................?.....c.......................................................................,.....4.....?.....W.....g.................................................................".....4.....E.....b.....i.....l.....m.....u.....}.............................&.....`.....g........................................."..........,.....2.....D.....e.....}.............................1.....7.....A.....Q.....`.....h... .m...".w...%.....(..........+.....,.........../.....0.1...1.]...3.g...4.....5.....6.....7.....8.....9.....;.....<.%...=.3...>.J...?.S...@.c...A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\sw.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	388458
Entropy (8bit):	5.356168167447509
Encrypted:	false
SSDEEP:	6144:24pV6wBz58kN6vhq//3UZFBIzDWs8ADjLKrYNguA/h5aS0DwV+ChZYeeq0e1k4H5:24bVd5B/3U/BLs8kMKguA/h5N1hZY+0u
MD5:	67A443A5C2EAAD32625EDB5F8DEB7852
SHA1:	A6137841E8E7736C5EDE1D0DC0CE3A44DC41013F
SHA-256:	41DFB772AE4C6F9E879BF7B4FA776B2877A2F8740FA747031B3D6F57F34D81DD
SHA-512:	E0FDFF1C3C834D8AF8634F43C2F16BA5B883A8D88DFD322593A13830047568FAF9F41D0BF73CD59E2E33C38FA58998D4702D2B0C21666717A86945D18B3F29E5
Malicious:	false
Preview:	..........K.h.L...i.W...j.c...k.r...l.}...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................#.....+.....2.....9.....@.....A.....B.....G.....k.....}...........................................................!.....%.....M.....c...........................................................$.....5.....?.....E.....\.....p.....}.................................................................6.....N.....p.................................................................?.....F.....X.........................................K.....U.....`.....l.....................................................%.....,...../.....0.....=.....D.....I.....P.....W.....c.............................6.....N.....c.................................................................L.....e................................................... .!...".1...%.U...(.o...*.....+.....,.........../.....0.....1. ...3.6...4.L...5.i...6.....7.....8.....9.....;.....<.....=.....>.....?.&...@.A...A.q.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\ta.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	987188
Entropy (8bit):	4.090571010189695
Encrypted:	false
SSDEEP:	3072:S3YCY5ynH4ASpuCkCxSiP84Gb/v5nB7zztROcA2P:SnVUdQO84Gb/v55zztROcA2P
MD5:	18EC8FF3C0701A6A8C48F341D368BAB5
SHA1:	8BFF8AEE26B990CF739A29F83EFDF883817E59D8
SHA-256:	052BCDB64A80E504BB6552B97881526795B64E0AB7EE5FC031F3EDF87160DEE9
SHA-512:	A0E997FC9D316277DE3F4773388835C287AB1A35770C01E376FB7428FF87683A425F6A6A605D38DD7904CA39C50998CD85F855CB33AE6ABAD47AC85A1584FE4E
Malicious:	false
Preview:	..........x.h.....i.....j.....k.....l.)...n.1...o.6...p.C...r.I...s.Z...t.c...v.x...w.....y.....z.....\|.....}...........................................................................................).....G.....P.......................M...........................................................,.....{.................&.....p.............................5.....W...........L.....d.......................#.....&.....8.....p.......................y...........+.....M.....Y.....a.....h.......................0.....K.....s.......................?...........$.....{.......................6.....w.....z.................1.....d...............................................1.....D...........c...........................................................$.....K.....c.....o.................S...........0.................U.....j........................... . ...".Z...%.....(.)...*.....+.....,.........../.....0.....1.....3.....4.7...5.....6.Z...7.....8.....9.$...;.g...<.....=.....>.....?.....@.0...A.y...C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\te.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	916416
Entropy (8bit):	4.338166638560127
Encrypted:	false
SSDEEP:	12288:iy/yX8OsABW3p1F9SviTlwJAg5NFO1Tr/p54JAQvfEC28+58XoX0DTq9OyU+0Ak1:vu8OkDY5YMZb
MD5:	A17F16D7A038B0FA3A87D7B1B8095766
SHA1:	B2F845E52B32C513E6565248F91901AB6874E117
SHA-256:	D39716633228A5872630522306F89AF8585F8092779892087C3F1230D21A489E
SHA-512:	371FB44B20B8ABA00C4D6F17701FA4303181AD628F60C7B4218E33BE7026F118F619D66D679BFFCB0213C48700FAFD36B2E704499A362F715F63EA9A75D719E7
Malicious:	false
Preview:	..........8.h.r...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.#...\|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....\|...........3.....g.............................@.....U...........4.....6.....B.....j.......................2.......................>.....`...........$.....U.....s...............................................,.....o.............................>.................<.................p.........................................8.......................M.....~.........................................P.....l.............................2.....T.........................................0.....W.....~.............................7.............................c.................7.....C.....s.......................T...........A.................p.......................C............... .....".....%.K...(.....*.....+.....,.......I.../.....0.....1.U...3.x...4.....5.....6.....7.....8."...9.V...;.....<.....=.....>.....?.....@.=...A...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\th.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	771431
Entropy (8bit):	4.388714549432334
Encrypted:	false
SSDEEP:	12288:5ZY31Mkgs3s5UvfZLRflsjj8FCG1LDoAGkEeuLAD57Kle9d8nyj9FR3o09XAyFHa:57yU5K54
MD5:	A32BA63FEEED9B91F6D6800B51E5AEAE
SHA1:	2FBF6783996E8315A4FB94B7D859564350EE5918
SHA-256:	E32E37CA0AB30F1816FE6DF37E3168E1022F1D3737C94F5472AB6600D97A45F6
SHA-512:	ADEBDE0F929820D8368096A9C30961BA7B33815B0F124CA56CA05767BA6D081ADF964088CB2B9FCAA07F756B946FFFA701F0B64B07D457C99FD2B498CBD1E8A5
Malicious:	false
Preview:	............h.....i.....j.....k.....l.....o.....p.'...r.-...s.>...t.G...v.\...w.i...y.o...z.~...\|.....}...............................................................................2.....V.............................\.....z...................................E.....r.............................&.....M.............................;.....V.....h.................1.............................+.....L.....X.....[.....j.......................2.....e...............................................&.....E.....~.................&.....Y.....t.................O.............................0.....3.....W.....x.........................................".....C.....U.....h.......................3.....E.................D.............................".....=.....d.......................e.................H....................................... .7...".L...%.....(.........+.-...,.>.....n.../.....0.....1.>...3.l...4.....5.....6.{...7.....8.....9.....;.....<.3...=.X...>.....?.....@.....A.-...C.r...D.....E...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\tr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	395016
Entropy (8bit):	5.625100269002306
Encrypted:	false
SSDEEP:	6144:xxl+G2KPlJi+kKD80GlTgAI7WTge95j/0+Vi1havX9vwiBrVmI:rlt2IlrRn57m5j/1
MD5:	5FF2E5C95067A339E3D6B8985156EC1F
SHA1:	7525B25C7B07F54B63B6459A0D8C8C720BD8A398
SHA-256:	14A131BA318274CF10DE533A19776DB288F08A294CF7E564B7769FD41C7F2582
SHA-512:	2414386DF8D7AB75DCBD6CA2B9AE62BA8E953DDB8CD8661A9F984EB5E573637740C7A79050B2B303AF3D5B1D4D1BB21DC658283638718FDD04FC6E5891949D1B
Malicious:	false
Preview:	..........".h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v."...w./...y.5...z.D...\|.J...}.\.....d.....i.....q.....y.......................................................................#.....1.....O.....\.....p.........................................................../.....9.....R.....\|...........................................................J.....b.....f.....n.....{.................................................................H.....V.....[.....c.....j.....q.............................................../.....>.....u.................................................................-.....F.....V.....].....`.....a.....k.....t.....{.............................$.....c.....i.........................................(.....2.....;.....B.....[.....{.............................@.....V.....].....c.....r............... .....".....%.....(.....*.....+.....,.......E.../.^...0.g...1.....3.....4.....5.....6.....7.:...8._...9.t...;.....<.....=.....>.....?.....@.....A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\uk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	673547
Entropy (8bit):	4.9167574403691825
Encrypted:	false
SSDEEP:	12288:Yoff7plonpyOKtPXiNcnZx75kB3IjE8EmLvLNiXEJq//GW:YoffaXMd59E7
MD5:	361A0E1F665B9082A457D36209B92A25
SHA1:	3C89E1B70B51820BB6BAA64365C64DA6A9898E2F
SHA-256:	BD02966F6C6258B66EAE7FF014710925E53FE26E8254D7DB4E9147266025CC3A
SHA-512:	D4D25FC58053F8CCE4C073846706DC1ECBC0DC19308BA35501E19676F3E7ED855D7B57AE22A5637F81CEFC1AA032BF8770D0737DF1924F3504813349387C08CF
Malicious:	false
Preview:	........g...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...\|.n...}.........................................................................'.....D.....].........................................J...............................................6.....J.....a...................................O.....[.....m.............................C.....M.....].....t...............................................L.....}.........................................=.....d...................................+.....b.....y.............................1.....Q.....}...................................3.....c.....j.....m.....n.....~.............................I...........U.....g...........1.....`............................>.....R.....`.......................C.....x................./.....A.....U..................... .....".....%.0...(.j........+.....,.........../.J...0.\...1.....3.....4.....5.A...6.....7.....8.....9.....;.....<.%...=.9...>.....?.....@.....A.3...C.m...D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\ur.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	585532
Entropy (8bit):	5.197200392190567
Encrypted:	false
SSDEEP:	12288:UA3OsGF8Pz0WEJytlkA+7Z5QzUExbW7DQQYrhu6co/9NjjFpvJK:UAe3A85oWB
MD5:	1CA4FA13BD0089D65DA7CD2376FEB4C6
SHA1:	B1BA777E635D78D1E98E43E82D0F7A3DD7E97F9C
SHA-256:	3941364D0278E2C4D686FAA4A135D16A457B4BC98C5A08E62AA12F3ADC09AA7F
SHA-512:	D0D9EB1AA029BD4C34953EE5F4B60C09CF1D4F0B21C061DB4EDE1B5EC65D7A07FC2F780ADE5CE51F2F781D272AC32257B95EEDF471F7295BA70B5BA51DB6C51D
Malicious:	false
Preview:	..........S.h.<...i.D...j.P...k._...l.j...n.r...o.w...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....4.........................................?.....K.....U.........................................3.....H.....g...................................B.....n........................................._.....................................................1.....\.....~.......................G.....k.....z...............................................<...................................\.....................................................:.....U.....s...........................................................$.................b.....w.......................9.....U.....q.....w...................................<.......................?....._.....k........................... .....".....%.0...(.R...*.....+.....,.........../.....0.....1.K...3.e...4.....5.....6.....7.L...8.....9.....;.....<.....=.....>.....?.....@.!...A.Q...C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\vi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	466098
Entropy (8bit):	5.819101554769623
Encrypted:	false
SSDEEP:	12288:3CwEs5kAfnzs0ACmwSxXwzIJWl+58Qagi7+URTJziV53f:3qOFfnzs0AHwSGz5A5rri7+UtliV53f
MD5:	DB0EB3183007DE5AAE10F934FFFACC59
SHA1:	E9EA7AEFFE2B3F5CF75AB78630DA342C6F8B7FD9
SHA-256:	DDABB225B671B989789E9C2CCD1B5A8F22141A7D9364D4E6EE9B8648305E7897
SHA-512:	703EFD12FCACE8172C873006161712DE1919572C58D98B11DE7834C5628444229F5143D231C41DA5B9CF729E32DE58DEE3603CB3D18C6CDD94AA9AA36FBF5DE0
Malicious:	false
Preview:	........_...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.!...t....v.?...w.L...y.R...z.a...\|.g...}.y.........................................................................................%.....2.....;.....b.....n.....x.........................................%...../.....F.....f.....q...............................................!.....2.....D.....T.....{.................................................................+.....V.....t...........................................................:.....D.....c...................................F.....................................................#.....A.....Q.....i.................................................................E.....z.............................4.....?.....O.....Z.....e.....x.............................<.....T.....z............................................. ."...".;...%.a...(..........+.....,.........../.....0.....1.G...3.T...4.p...5.....6.....7.....8.....9.....;.+...<.5...=.F...>.a...?.m...@.....A.....C...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\zh-CN.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	340874
Entropy (8bit):	6.70707570391969
Encrypted:	false
SSDEEP:	6144:fmLpS8IeOL27M807pnCKjEWkE0G5xNlEPeVplD:fmLQmK2I1nCKjEjG5xNlEPe
MD5:	82326E465E3015C64CA1DB77DC6A56BC
SHA1:	E8ABE12A8DD2CC741B9637FA8F0E646043BBFE3D
SHA-256:	6655FD9DCDFAF2ABF814FFB6C524D67495AED4D923A69924C65ABEAB30BC74FB
SHA-512:	4989789C0B2439666DDA4C4F959DFFC0DDCB77595B1F817C13A95ED97619C270151597160320B3F2327A7DAFFC8B521B68878F9E5E5FB3870EB0C43619060407
Malicious:	false
Preview:	........,...h.J...i.R...j.U...k.d...l.k...m.s...o.y...p.~...r.....s.....t.....v.....w.....\|.....}.......................................................%.....'.....,.....Z.....c.....o.......................................................................C.....[.....a.....m.................................................................!.....9.....E.....i.....x.....~.................................................................2.....J.....b.....n.....t.....\|...........................................................%.....=.....^......................................................................./.....C.....R.....Y.....\.....^.....s.....\|.........................................>.....D.......................................................................(.....@.....j.....\|...............................................%... .+...".7...%.R...(.g...*.\|...+.....,.........../.....0.....1.....3. ...4.5...5.V...6.....7.....8.....9.....;.....<.....=.....>.,...?.<...@.T...A.....C.....D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\locales\zh-TW.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	338121
Entropy (8bit):	6.721086394879431
Encrypted:	false
SSDEEP:	6144:zQmZEIQee2hZuwv+2440f5lHz8wMCM/9ylTN:cvIpn+2440f5lHzgT/C
MD5:	2456BF42275F15E016689DA166DF9008
SHA1:	70F7DE47E585DFEA3F5597B5BBA1F436510DECD7
SHA-256:	ADF8DF051B55507E5A79FA47AE88C7F38707D02DFAC0CC4A3A7E8E17B58C6479
SHA-512:	7E622AFA15C70785AAF7C19604D281EFE0984F621D6599058C97C19D3C0379B2EE2E03B3A7EC597040A4EEE250A782D7EC55C335274DD7DB7C7CA97DDCFD378A
Malicious:	false
Preview:	............h.....i.+...j./...k.>...l.I...n.Q...o.V...p.^...r.d...s.u...t.~...v.....w.....y.....z.....\|.....}.............................................................>.....G.....S.....b.....h.....................................................!.....0.....H.....N.....Z.....i.....r.....~.................................................................2.....D.....J.....S....._.....k.....q.....w.....}.......................................................................).....5.....B.....W.....c.....o.........................................&...../.....;.....G.....Y.....t.....w...............................................................................................[.........................................?.....K.....W.....].....i.....o.....u.........................................E.....T.....Z.....`.....l............... .....".....%.....(.....*.....+.....,.......C.../.[...0.d...1.....3.....4.....5.....6.....7.%...8.7...9.C...;.U...<.e...=.u...>.....?.....@.....A.....C.....D...

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\main.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162036224
Entropy (8bit):	6.733016750711471
Encrypted:	false
SSDEEP:	1572864:OCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:0DAgZi
MD5:	94F3E2F32CED13FD99CC314BEB587233
SHA1:	1B7293564727A749658F5B7553A871E17BEB7527
SHA-256:	C98F0F5B89C6DAC1482286FAA2E33A84230C26EA38DA4E013665582C9A04213B
SHA-512:	3377804564E50D01D3C4B5376B0D40FB380E0911F3CE09BC6D8A01857AEBEE61D893877189AA719AAF394189AEE4B80D864443E81127534A13DC15F353DABB9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........."......v.....................@..........................................`...........................................D.od..e.H.T............p..,.@.............`.....:.......................:.(...`...8...........P,H......iD......................text....u.......v.................. ..`.rdata...`k......bk..\|..............@..@.data....bE...L.......K.............@....pdata..,.@..p....@...V.............@..@.00cfg..(............J..............@..@.gxfg....B.......B...L..............@..@.retplne.....`...........................rodata......p...................... ..`.tls................................@....voltbl.R...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..`.......

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	5430320
Entropy (8bit):	7.995406820581218
Encrypted:	true
SSDEEP:	98304:/Zgm9tHEEIcjWbEvKfwa2sEJFz993CNh1QeHQF5qrwrw5z0uxRRrY2kuDYj9ds:RgAtkEx4EKfatyNhHwFkkrw5IcRRtkFs
MD5:	7971A016AED2FB453C87EB1B8E3F5EB2
SHA1:	92B91E352BE8209FADCF081134334DEA147E23B8
SHA-256:	9CFD5D29CDE3DE2F042E5E1DA629743A7C95C1211E1B0B001E4EEBC0F0741E06
SHA-512:	42082AC0C033655F2EDAE876425A320D96CDAEE6423B85449032C63FC0F7D30914AA3531E65428451C07912265B85F5FEE2ED0BBDB362994D3A1FA7B14186013
Malicious:	false
Preview:	............f.R......&....h).....,...4_?...4.G...4.J...4.\...4.e...4.l...4Ho...4.u...4.w...4.y...4.}...4....4&....4H....4.....4....4.....4F....4.....4.....4[....4d....4e....4.....4.....4.....4l....4.....4.....4.....4.....4g....4.....5.....5?....5.....5.....5H....5.:...5.=..~5]D...5oE...5;F...57H...5.H...5mI...5}M...56O...5.T...5{y...5c....5.....5.....5.....5.....5.....5G....5W....<.....<Y(...<....<j,...<N-...<.1..,<.2..-</=...<.H../<.T..0<._...@.p...@.x...@g\|...@}}...@.~...@.i...Agv...A]x...A.....A.....A'....A....A.....A.....AT....Al....A.....A.....Ao....A$....A.....A2....A=....Ae....A.....A.....AS!...A.%...AH,...Am:...AM<...A:>...A.@...AuB...A.C.. AZF...N....N.....N.....Nc....NL....N....NM....N.....O.....O}....O.....O.....O#....O.....O}....O.....Od....O4....O.....O.0...O.7...Og>...O.A..$O.W..%O.Y..&O]c..'O.d..(O.i..)O.k..Opm..+O.x..,O(\|..-Oq....O..../O....0O....1O...2Og...3O....4O....5Ot...6O....7O....8OV...9OB...:O....;Om...<O....=O....>O....?Om...@OI...AO....BO....CO....DO..

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\resources\app.asar

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	15726135
Entropy (8bit):	5.614629529127722
Encrypted:	false
SSDEEP:	49152:QnmwIpMFUZRIkD6ootolZoIZL1AmkZWRHUfd4hZnACjvodKKGg/Pugru304YzKbD:t//8pu8G
MD5:	DEC386BC90FEFDBB4DB9CABC42B3F01C
SHA1:	FC166614F827FAD9C04ED1192DC59182EB1814F0
SHA-256:	1E97D7ECACFE525954A050A69B29E82B079C6CCAC98C0EFFDE74AF789A285174
SHA-512:	A41D424C51A92F2D4C2595840AC2604E6FD9BEC61E57C3D913A30B62EAB613B5E25199044410A670EDD9FA26E57B4FEAE18D02A79BD6366787035C1853ED8B48
Malicious:	false
Preview:	.....=...=...=..{"files":{"build.bat":{"size":71,"integrity":{"algorithm":"SHA256","hash":"f7e3079b5a4b9ddbc7763f8e9a8f454629736d394740cdb4b4b71d7c1a86a7e3","blockSize":4194304,"blocks":["f7e3079b5a4b9ddbc7763f8e9a8f454629736d394740cdb4b4b71d7c1a86a7e3"]},"offset":"0"},"ffffpackage-lock.json":{"size":116576,"integrity":{"algorithm":"SHA256","hash":"3ae656fa013ed5e54daad35af62b40f23e386f7336c7bf8aff018061d2228b8b","blockSize":4194304,"blocks":["3ae656fa013ed5e54daad35af62b40f23e386f7336c7bf8aff018061d2228b8b"]},"offset":"71"},"icon.ico":{"size":45289,"integrity":{"algorithm":"SHA256","hash":"0f71ed87b41029fc99573d175f17b36d00cdbc5b6bb9c2c72b31d636c9e1b390","blockSize":4194304,"blocks":["0f71ed87b41029fc99573d175f17b36d00cdbc5b6bb9c2c72b31d636c9e1b390"]},"offset":"116647"},"input.js":{"size":7155,"integrity":{"algorithm":"SHA256","hash":"5938dab37ddf764929ce9a35e3b2e659e93ae498f07742c2cf58a7d90740174f","blockSize":4194304,"blocks":["5938dab37ddf764929ce9a35e3b2e659e93ae498f07742c2cf58a7d

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\resources\elevate.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.442687067441468
Encrypted:	false
SSDEEP:	3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
MD5:	792B92C8AD13C46F27C7CED0810694DF
SHA1:	D8D449B92DE20A57DF722DF46435BA4553ECC802
SHA-256:	9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
SHA-512:	6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\snapshot_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	162352
Entropy (8bit):	4.860588090157433
Encrypted:	false
SSDEEP:	1536:uebVb91USSzM+uCPNgswpzHD41OzB965pUB8/DR9BgyLMRPoq/rX4JHj/kMKE0YC:uTgsED41OV965LXMj4zF2Xl9B
MD5:	8FEF5A96DBCC46887C3FF392CBDB1B48
SHA1:	ED592D75222B7828B7B7AAB97B83516F60772351
SHA-256:	4DE0F720C416776423ADD7ADA621DA95D0D188D574F08E36E822AD10D85C3ECE
SHA-512:	E52C7820C69863ECC1E3B552B7F20DA2AD5492B52CAC97502152EBFF45E7A45B00E6925679FD7477CDC79C68B081D6572EEED7AED773416D42C9200ACCC7230E
Malicious:	false
Preview:	.........4D11.0.226.20-electron.0...........................................6.. ...`.......06..a........a........a........ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	data
Category:	dropped
Size (bytes):	476792
Entropy (8bit):	5.595608653079527
Encrypted:	false
SSDEEP:	3072:qqgtKzy7vqUSMd+5ZTR4ymbsLIniZiYIU+gTh3WOdvmttow2LyZDvooPmdZwmNgi:lgEzy2NTROsLftIU+gTQ4E2ro+dOmp
MD5:	A373D83D4C43BA957693AD57172A251B
SHA1:	8E0FDB714DF2F4CB058BEB46C06AA78F77E5FF86
SHA-256:	43B58CA4057CF75063D3B4A8E67AA9780D9A81D3A21F13C64B498BE8B3BA6E0C
SHA-512:	07FBD84DC3E0EC1536CCB54D5799D5ED61B962251ECE0D48E18B20B0FC9DD92DE06E93957F3EFC7D9BED88DB7794FE4F2BEC1E9B081825E41C6AC3B4F41EAB18
Malicious:	false
Preview:	.........K..11.0.226.20-electron.0..............................................`....f..8...........h...a........a........aT.......ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5209088
Entropy (8bit):	6.329767466271418
Encrypted:	false
SSDEEP:	49152:tG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAq:c7iDPqjvzO1Lhgf49zT7grg4
MD5:	A0845E0774702DA9550222AB1B4FDED7
SHA1:	65D5BD6C64090F0774FD0A4C9B215A868B48E19B
SHA-256:	6150A413EBE00F92F38737BDCCF493D19921EF6329FCD48E53DE9DBDE4780810
SHA-512:	4BE0CB1E3C942A1695BAE7B45D21C5F70E407132ECC65EFB5B085A50CDAB3C33C26E90BD7C86198EC40FB2B18D026474B6C649776A3CA2CA5BFF6F922DE2319B
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......?..........&8...................................... Q...........`A........................................X.J.~.....J.P.....P.......N..c............P..}....J.....................h.J.(...@.?.8...........x.K.P............................text...".?.......?................. ..`.rdata..$.....?.. ....?.............@..@.data...`.....K.......K.............@....pdata...c....N..d...\M.............@..@.00cfg..(.....P.......N.............@..@.gxfg...`,... P.......N.............@..@.retplne\....PP.......N..................tls....Q....`P.......N.............@....voltbl.8....pP.......N................._RDATA........P.......N.............@..@.rsrc.........P.......N.............@..@.reloc...}....P..~....N.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\7z-out\vulkan-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	920576
Entropy (8bit):	6.556557427650666
Encrypted:	false
SSDEEP:	24576:PR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:PR1l1culw6Z5WUDYsH56g3P0zAk7
MD5:	0E4E0F481B261EA59F196E5076025F77
SHA1:	C73C1F33B5B42E9D67D819226DB69E60D2262D7B
SHA-256:	F681844896C084D2140AC210A974D8DB099138FE75EDB4DF80E233D4B287196A
SHA-512:	E6127D778EC73ACBEB182D42E5CF36C8DA76448FBDAB49971DE88EC4EB13CE63140A2A83FC3A1B116E41F87508FF546C0D7C042B8F4CDD9E07963801F3156BA2
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." .....l................................................................`A............................................<!..T...P...............pn..............<...Tn......................8m..(...@...8............................................text....k.......l.................. ..`.rdata..4............p..............@..@.data....L...P... ...6..............@....pdata..pn.......p...V..............@..@.00cfg..(...........................@..@.gxfg... (... ...*..................@..@.retplne\....P...........................tls.........`......................@....voltbl.8....p.........................._RDATA..............................@..@.rsrc...............................@..@.reloc..<...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\app-64.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	65328807
Entropy (8bit):	7.999994603845959
Encrypted:	true
SSDEEP:	1572864:6rziNh/b8cKauEXEnREpwWGD5Pb2PKDLrWE36DV:Nh/Tu+W/kvEKJ
MD5:	0DC074E36EBCAD0C00161DCEDC8EE6A7
SHA1:	04A08C41192A486FBF7992775C5243D10ABA158B
SHA-256:	6189604B1BA38E8375C2C8CD61646925CDB4C8CEB338E9688245850C4F44DEC2
SHA-512:	9A555305C657D2E753A6FD908566C289C26E702C4FD06A22E2011A3D713B6199FF396F1842D06DB01ACBEF75D600F4E363F0D8B03D8BAFD717CF7CE1D5612CAF
Malicious:	false
Preview:	7z..'....D..b.......%........B.......]...6...#k.![y.`.Gr#.f..F.....c}.R\|..j=...,._..z..gC5Q.j...7S.:0`..o..^.._e....0.....K....T).XS.CPP'....B...&...<..f........`".U01o...QI.3i.].vD.d9...V...>%.+..5...~M.,.[.....q..1..../.&.h...4;!<..-O......4r......8..a.\I....=...!NNs.QB.."..M?....J..D...bvy....u#.:,..y..5T^.&'% !"....-...u<kJ..;..9..X6....v..b...T.9u..#.v.(l....n.......v...ZE.i...uEcGJ!c+.;...Z.n.:.0...-...!..$...^l-`A%kX<..,.....2...........^....a...L...s.x..RN.w..]@;~ymo:J.....i..M......h..Z.nL...........J}J.. .l...O...[5.>.5........;....o..up..1.N4H9.K..es....l.(.-W=(z.OR.\|r .k.......\.?}.ua..L.~..'K).&...iIAoe...u.. ...Z.f../8P.....H._.!........@_.S..m.*F....g....-....i.:&i..h.n..6&..H.}..!.T...e....S.........$.....Sazv...[.W9+.A..}P^.p........uFh..\o...Ft...$.p..-.....:).......g\...&>.^.<..!8N.@mmC....?.Q.(.]t....8.i.........!fh..dd....)...eL.L`.a..Z1hD.$.j..[Fz..I..b.C.\|...._\.w$..5.rB.+....B..&!....i..J..8..7..u..x.h...?......!p.

C:\Users\user\AppData\Local\Temp\nsdAE7E.tmp\nsis7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434176
Entropy (8bit):	6.584811966667578
Encrypted:	false
SSDEEP:	6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5:	80E44CE4895304C6A3A831310FBF8CD0
SHA1:	36BD49AE21C460BE5753A904B4501F1ABCA53508
SHA-256:	B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
SHA-512:	C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\start.exe

Download File

Process:	C:\Users\user\Desktop\Sldl84wxy8.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	5.390808577309735
Encrypted:	false
SSDEEP:	1536:SaKFoNbEkySYKumUYFOy5biAPY0JG4aRjnl7RUr+TG5x:SawoNbEkAKumUYFD5biF0JejxSsCx
MD5:	C1ADE258F05C512E98EBC4D9D1165F8A
SHA1:	ACF20F6A7DC7841AE06F801B887289FDC99E0488
SHA-256:	447EAE52AB1979405497866C72DF7EC0703085AD6946AB0127F612B1518F8759
SHA-512:	5B652E0EF6293D7BAEB7E9D8B79322EC65E98D748E1DF492099FA6692D0BBC78F032DF68E7028A28AF06B5C27394456159351A6469FDAF777E6EB98609331076
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\start.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\start.exe, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\start.exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\Temp\start.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d................................. ... ....@.. .......................`............`.................................H...S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......,z.................................................................V..;...$0.xC.=VD..b......9A../.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(A......2~.....oB....s..........()...:(...(...:....(+...:....('...:....((...9.....(y...~..(...........(..... .....!...V~%...(3....&...(.....r.;.p(....r.;.p(r...."......4...sC....%...~.....&.....

C:\Users\user\AppData\Local\Temp\svchost (3).exe

Download File

Process:	C:\Users\user\Desktop\Sldl84wxy8.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	452920
Entropy (8bit):	7.97719843500253
Encrypted:	false
SSDEEP:	12288:2xdbI79je2EUyZzvUQTw/6Y378+rnoLcaQ:sFI79jDEU8vJTw/nr8SoL2
MD5:	8CD2675E19A8B1DCCF0DBF082F42AB33
SHA1:	3B6A8A51F53D8EC6E773F2A28F80FB003311597B
SHA-256:	392CA70B63B6DB8E0DC3AAB0B6506169D5D9D2CAD36598D037794BE5A82BEC09
SHA-512:	B4260FE93196D71F38AB386A17DB0AC91A1116EF155771F789579D3150B4C74ABB23F289BC042CED1FE7B905F1F1645435837223B3CA331D1E1D55C7EB4A5711
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...O............."...0.pq............... ....@...... ....................................`.........................................................................X...................8............................................................ ..H............text...pq... ...r.................. ..`.rsrc................t..............@..@........................................H........2..B]......I...................................................H.......F~.....o....o....F~.....o....o....Vs.........s...........(....:.(......}....f.,..,...,...,...i..i.....(#....($....r...p(....r...p(.........(%...(&...t........oR....('...%.o(...%.o)...%.o...%.o+...o,.......io-........{...."..}......{......{.....3...}.....(8...,..o7...+..(8....~9...o5...J.(:...~.....o;...J.(:...~.....o<.....{...."..}......{......{.....3...}.....(8...,..(=....(8...**.

C:\Users\user\AppData\Local\Temp\tmpC5CE.tmp.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\start.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.0282135521353535
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5oCHyg4EaKC5lovmqRDCHyg4E2J5xAInTRIMQ1WHVZPy:hWKqTtT6CHhJaZ5lovmq1CHhJ23fTtQh
MD5:	3AE8110717FED9663A3BE2139C6092CE
SHA1:	5E72BAF974A45D90CC4940208EE0BD3F2471629A
SHA-256:	F44ABD1196D2647445AF97FF1102F05032C21F216C757A53F322D99EC3C7D006
SHA-512:	387EF8DCE4C98AD949EB172A8DE325CFBA513102A9C2A812BA697C68A4F434D01546B5D092492A327FBA3B30883F21511FFC787B76381B5200A52C2B33E3C2E1
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Roaming\svchos.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmpC5CE.tmp.bat" /f /q..

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\Updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	65711823
Entropy (8bit):	7.999943485811978
Encrypted:	true
SSDEEP:	1572864:9rziNh/b8cKauEXEnREpwWGD5Pb2PKDLrWE36D77:Yh/Tu+W/kvEKf7
MD5:	8701FCD188315FA69245FB99E07DF60D
SHA1:	511FF357D2BA1EAE568E54627C115218AC9C2F27
SHA-256:	A60C94ED95D06FDEC41A1665413BDE68A9B501C2781417848AC3D60631163001
SHA-512:	826AA81D962EA6C1D8C8B3B4471136A5EA5AD1844D92289859D7A951B339FC7BA06386AD3D71BFBDD02538DDA98F107ED28BB1655E58BDA727798DBDEA67F21B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@..........................p.......{....@..........................................................................................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\main\65fb37c4-965f-4a20-8228-f0ff42ba6aa0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.6398626378043994
Encrypted:	false
SSDEEP:	6:YKWCRgXt9RdrtybHOUvkWu2nukkUgzIdmASt3GSlYdXHn7SxPGDm99iZIn:YKWSg99rrt+uGzBAcYhYdXH7ShjYIn
MD5:	831E29DF9C0F9FEFC8E21D8090A1E492
SHA1:	4670FFBC386390309277548EC99285611D80C44D
SHA-256:	5CAF9BD6058020B546882865388EA0AA96875F2D9C768C5ED5509B5BBB504944
SHA-512:	13A83C24A3188B03D68F118202B24BFF788C9A5C7BE654A766F0F79090BE71B004FDD51E83564F328F3717A7124E5EFB380C2E68B4D58208C9F1E869C90C5A82
Malicious:	false
Preview:	{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADzh9Ir+f+5TahV5u3hm9EMAAAAAAIAAAAAABBmAAAAAQAAIAAAACOndDFb+7//2nO/cbyfQiW89g4Ar2SAvSMVTLl/UlBEAAAAAA6AAAAAAgAAIAAAAHpunrcles3UcYbXjPTZdIxcCJmeCs2VCBrJbiedHSpcMAAAAOsjivxt/8HoT/sL+f/UiZ88nYuVqWLKrlhkXnGdCaUhc6gc6NMq/c07Rn7zJ0FUwUAAAACIclgtyTq/Zub42K6RV5WeaZMNHcwoHaY4y7jqUeXgsW2a1wqBhaAehilyR3/8Ne6St/sHSK53t5O1YUZeWz4O"}}

C:\Users\user\AppData\Roaming\main\Local State (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.6398626378043994
Encrypted:	false
SSDEEP:	6:YKWCRgXt9RdrtybHOUvkWu2nukkUgzIdmASt3GSlYdXHn7SxPGDm99iZIn:YKWSg99rrt+uGzBAcYhYdXH7ShjYIn
MD5:	831E29DF9C0F9FEFC8E21D8090A1E492
SHA1:	4670FFBC386390309277548EC99285611D80C44D
SHA-256:	5CAF9BD6058020B546882865388EA0AA96875F2D9C768C5ED5509B5BBB504944
SHA-512:	13A83C24A3188B03D68F118202B24BFF788C9A5C7BE654A766F0F79090BE71B004FDD51E83564F328F3717A7124E5EFB380C2E68B4D58208C9F1E869C90C5A82
Malicious:	false
Preview:	{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADzh9Ir+f+5TahV5u3hm9EMAAAAAAIAAAAAABBmAAAAAQAAIAAAACOndDFb+7//2nO/cbyfQiW89g4Ar2SAvSMVTLl/UlBEAAAAAA6AAAAAAgAAIAAAAHpunrcles3UcYbXjPTZdIxcCJmeCs2VCBrJbiedHSpcMAAAAOsjivxt/8HoT/sL+f/UiZ88nYuVqWLKrlhkXnGdCaUhc6gc6NMq/c07Rn7zJ0FUwUAAAACIclgtyTq/Zub42K6RV5WeaZMNHcwoHaY4y7jqUeXgsW2a1wqBhaAehilyR3/8Ne6St/sHSK53t5O1YUZeWz4O"}}

C:\Users\user\AppData\Roaming\svchos.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\start.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	5.390808577309735
Encrypted:	false
SSDEEP:	1536:SaKFoNbEkySYKumUYFOy5biAPY0JG4aRjnl7RUr+TG5x:SawoNbEkAKumUYFD5biF0JejxSsCx
MD5:	C1ADE258F05C512E98EBC4D9D1165F8A
SHA1:	ACF20F6A7DC7841AE06F801B887289FDC99E0488
SHA-256:	447EAE52AB1979405497866C72DF7EC0703085AD6946AB0127F612B1518F8759
SHA-512:	5B652E0EF6293D7BAEB7E9D8B79322EC65E98D748E1DF492099FA6692D0BBC78F032DF68E7028A28AF06B5C27394456159351A6469FDAF777E6EB98609331076
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\svchos.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d................................. ... ....@.. .......................`............`.................................H...S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......,z.................................................................V..;...$0.xC.=VD..b......9A../.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(A......2~.....oB....s..........()...:(...(...:....(+...:....('...:....((...9.....(y...~..(...........(..... .....!...V~%...(3....&...(.....r.;.p(....r.;.p(r...."......4...sC....%...~.....&.....

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.3723313382305715
Encrypted:	false
SSDEEP:	6144:QFVfpi6ceLP/9skLmb0dyWWSPtaJG8nAge35OlMMhA2AX4WABlguNyiL:IV1DyWWI/glMM6kF7Mq
MD5:	CCB5F7184C70764C7F1B9CD63AADA9D3
SHA1:	54FD6B303935E1F59467C90D7AF6A54936B894F3
SHA-256:	9AA44559EEF53D96745F6B3ABECB8DD32F5CE6480B264495026ECB482DD3C255
SHA-512:	6DDDEA9A765C7E2BEF5361E8453E6A706E898ACB14081F7BD34E498236260A1118BB48414F071CA4FBEA9F6E9769B6E3D2A71D1A612E78B74CE7522213CB4184
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...$...............................................................................................................................................................................................................................................................................................................................................TI.,........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.999988640433959
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Sldl84wxy8.exe
File size:	66'234'368 bytes
MD5:	0b459466e3619d2a29bb93ea2dac077a
SHA1:	b55a18a2d13589b81cae82c691d83e7961799d44
SHA256:	a7adeed2290a6e7d4b061a44337ebbcdc91a9800e40cc96a31632e3e52d710ff
SHA512:	ab1bd6465ce9e956bf4d9576552ab85541a6b6595817ca68e651264630d728388938b8f0b85353e2278bbee73b6ca427027fdfc8e1fc041a19467b41d29f320c
SSDEEP:	1572864:iFffrC4ndj0tJT5vMiaUMeRBFGkdWEeJFj3w:gf24dj6T5TaUTBbdheXw
TLSH:	A6E733102189D9B9D1F8A5BDDF2FD90214EC53A129D16BFF1C15C3250EBFEE2A89A1C1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................................................@..................................E.....................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4014ad
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	a9c887a4f18a3fede2cc29ceea138ed3

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000008h
nop
mov eax, 00000004h
push eax
mov eax, 00000000h
push eax
lea eax, dword ptr [ebp-04h]
push eax
call 00007F74346C50E1h
add esp, 0Ch
mov eax, 0040148Bh
push eax
call 00007F74346C5123h
mov eax, 00000001h
push eax
call 00007F74346C5120h
add esp, 04h
mov eax, 00030000h
push eax
mov eax, 00010000h
push eax
call 00007F74346C5114h
add esp, 08h
mov eax, dword ptr [0432B4F4h]
mov ecx, dword ptr [0432B4F8h]
mov edx, dword ptr [0432B4FCh]
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-04h]
push eax
mov eax, dword ptr [0432C000h]
push eax
push edx
push ecx
mov eax, dword ptr [ebp-08h]
push eax
call 00007F74346C50EEh
add esp, 14h
mov eax, dword ptr [0432B4F4h]
mov ecx, dword ptr [0432B4F8h]
mov edx, dword ptr [0432B4FCh]
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [edx]
push eax
mov eax, dword ptr [ecx]
push eax
mov eax, dword ptr [ebp-08h]
mov eax, dword ptr [eax]
push eax
call 00007F74346C4ECCh
add esp, 0Ch
push eax
call 00007F74346C50C4h
add esp, 04h
leave
ret
push ebp
mov ebp, esp
sub esp, 00000004h
nop
mov eax, dword ptr [0432B4F4h]
mov ecx, dword ptr [ebp+08h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00000000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3f2b480	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3f2d000	0x2f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3f2b4d0	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x640	0x800	9b1c7bee845c3a1478ec3077d89ce9ca	False	0.39892578125	data	4.621842099867178	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x3f29683	0x3f29800	58782a61c34662ad50ed94be32821d00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x3f2c000	0x4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3f2d000	0x2f8	0x400	a059bed3e4dc9fe2c31e58a608b3e985	False	0.3603515625	data	4.300210635374267	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x3f2d058	0x29f	XML 1.0 document, ASCII text	English	United States	0.47391952309985097

Imports

DLL	Import
msvcrt.dll	malloc, memset, strcmp, strcpy, getenv, sprintf, fopen, fwrite, fclose, __argc, __argv, _environ, _XcptFilter, __set_app_type, _controlfp, __getmainargs, exit
shell32.dll	ShellExecuteA
kernel32.dll	SetUnhandledExceptionFilter

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/28/24-16:25:04.014274	TCP	2850454	ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT)	4449	49711	94.156.66.112	192.168.2.8
03/28/24-16:25:14.107425	TCP	2035595	ET TROJAN Generic AsyncRAT Style SSL Cert	1339	49716	185.196.11.223	192.168.2.8
03/28/24-16:25:14.107425	TCP	2030673	ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server)	1339	49716	185.196.11.223	192.168.2.8
03/28/24-16:25:04.014274	TCP	2848152	ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant)	4449	49711	94.156.66.112	192.168.2.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 16:25:03.628742933 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:03.812103033 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:03.814532995 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:03.828510046 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:04.014273882 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:04.019958019 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:04.209973097 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:04.319539070 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:05.003329039 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:05.237503052 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:05.237627983 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:05.468978882 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:13.703939915 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:13.890623093 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:13.890762091 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:13.900280952 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:14.107424974 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:14.107485056 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:14.107537985 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:14.109855890 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:14.298326015 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:14.366388083 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:15.087502003 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:15.336795092 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:15.340485096 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:15.588445902 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:16.323534012 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:16.547460079 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:16.547656059 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:16.781774998 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:17.761652946 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:17.803894997 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:17.987245083 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:17.997247934 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:18.234777927 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:18.234847069 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:18.469177008 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:24.154799938 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:24.399308920 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:24.399363995 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:24.591212034 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:24.632019043 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:24.818409920 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:24.830296040 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:25.071291924 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:25.072490931 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:25.324430943 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:26.721329927 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:26.772665977 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:26.958996058 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:27.007133961 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:27.740464926 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:27.969072104 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:27.969216108 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:28.203494072 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:28.722661018 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:28.772672892 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:28.956020117 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:28.958425999 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:29.187840939 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:29.187947989 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:29.422121048 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:30.629014015 CET	49720	443	192.168.2.8	104.21.95.148
Mar 28, 2024 16:25:30.629057884 CET	443	49720	104.21.95.148	192.168.2.8
Mar 28, 2024 16:25:30.629132986 CET	49720	443	192.168.2.8	104.21.95.148
Mar 28, 2024 16:25:30.637778044 CET	49720	443	192.168.2.8	104.21.95.148
Mar 28, 2024 16:25:30.637800932 CET	443	49720	104.21.95.148	192.168.2.8
Mar 28, 2024 16:25:30.839198112 CET	443	49720	104.21.95.148	192.168.2.8
Mar 28, 2024 16:25:30.839981079 CET	49720	443	192.168.2.8	104.21.95.148
Mar 28, 2024 16:25:30.840006113 CET	443	49720	104.21.95.148	192.168.2.8
Mar 28, 2024 16:25:30.841105938 CET	443	49720	104.21.95.148	192.168.2.8
Mar 28, 2024 16:25:30.841186047 CET	49720	443	192.168.2.8	104.21.95.148
Mar 28, 2024 16:25:30.844078064 CET	49720	443	192.168.2.8	104.21.95.148
Mar 28, 2024 16:25:30.844142914 CET	443	49720	104.21.95.148	192.168.2.8
Mar 28, 2024 16:25:30.844315052 CET	443	49720	104.21.95.148	192.168.2.8
Mar 28, 2024 16:25:30.844377041 CET	49720	443	192.168.2.8	104.21.95.148
Mar 28, 2024 16:25:30.844377041 CET	49720	443	192.168.2.8	104.21.95.148
Mar 28, 2024 16:25:31.269540071 CET	49721	443	192.168.2.8	192.236.232.25
Mar 28, 2024 16:25:31.269578934 CET	443	49721	192.236.232.25	192.168.2.8
Mar 28, 2024 16:25:31.269661903 CET	49721	443	192.168.2.8	192.236.232.25
Mar 28, 2024 16:25:31.270121098 CET	49721	443	192.168.2.8	192.236.232.25
Mar 28, 2024 16:25:31.270140886 CET	443	49721	192.236.232.25	192.168.2.8
Mar 28, 2024 16:25:31.846968889 CET	443	49721	192.236.232.25	192.168.2.8
Mar 28, 2024 16:25:31.847573042 CET	49721	443	192.168.2.8	192.236.232.25
Mar 28, 2024 16:25:31.847599030 CET	443	49721	192.236.232.25	192.168.2.8
Mar 28, 2024 16:25:31.848711967 CET	443	49721	192.236.232.25	192.168.2.8
Mar 28, 2024 16:25:31.848778009 CET	49721	443	192.168.2.8	192.236.232.25
Mar 28, 2024 16:25:31.849741936 CET	49721	443	192.168.2.8	192.236.232.25
Mar 28, 2024 16:25:31.849778891 CET	443	49721	192.236.232.25	192.168.2.8
Mar 28, 2024 16:25:31.849833965 CET	49721	443	192.168.2.8	192.236.232.25
Mar 28, 2024 16:25:31.979264975 CET	49722	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:31.979302883 CET	443	49722	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:31.979398966 CET	49722	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:31.979815006 CET	49722	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:31.979825974 CET	443	49722	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.186038971 CET	443	49722	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.186733007 CET	49722	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.186762094 CET	443	49722	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.187822104 CET	443	49722	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.187887907 CET	49722	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.188915968 CET	49722	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.188961029 CET	443	49722	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.189080954 CET	443	49722	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.189138889 CET	49722	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.189167976 CET	49722	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.192225933 CET	49723	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.192269087 CET	443	49723	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.192346096 CET	49723	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.192735910 CET	49723	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.192750931 CET	443	49723	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.394629002 CET	443	49723	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.395088911 CET	49723	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.395114899 CET	443	49723	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.396328926 CET	443	49723	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.396389008 CET	49723	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.397222042 CET	49723	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.397255898 CET	443	49723	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.397377968 CET	443	49723	172.67.142.111	192.168.2.8
Mar 28, 2024 16:25:32.397428989 CET	49723	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:32.397444963 CET	49723	443	192.168.2.8	172.67.142.111
Mar 28, 2024 16:25:33.210758924 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:33.462707996 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:33.462934017 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:33.652203083 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:33.694588900 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:33.885093927 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:33.886940956 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:34.133699894 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:34.133821964 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:34.383697033 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:39.054651022 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:39.281815052 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:39.281944036 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:39.515863895 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:40.012826920 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:40.053965092 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:40.237577915 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:40.239219904 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:40.468945026 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:40.469059944 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:40.703484058 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:42.273099899 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:42.524619102 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:42.524682999 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:42.713205099 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:42.757046938 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:42.944133997 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:42.945858002 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:43.196260929 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:43.196342945 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:43.446341991 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:50.383127928 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:50.609690905 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:50.610013008 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:50.844357014 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:51.335652113 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:51.586812019 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:51.586899042 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:51.775150061 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:51.819555044 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:52.006266117 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:52.008096933 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:52.099354029 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:52.147725105 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:52.259152889 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:52.259291887 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:52.331156015 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:52.333247900 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:52.511178017 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:52.565700054 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:52.565794945 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:25:52.797271013 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:25:56.749011040 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:56.803951025 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:25:56.990761995 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:25:57.038333893 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:00.398194075 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:00.649468899 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:00.649574041 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:00.837960958 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:00.882052898 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:01.068902016 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:01.070660114 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:01.321548939 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:01.321798086 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:01.571270943 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:01.710705996 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:01.944269896 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:01.944328070 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:02.175539017 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:09.461064100 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:09.711911917 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:09.712007046 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:09.900337934 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:09.944643021 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:10.131238937 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:10.133199930 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:10.384614944 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:10.384692907 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:10.633770943 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:10.995918989 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:11.038357019 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:11.221708059 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:11.223612070 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:11.456767082 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:11.456854105 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:11.687978983 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:13.043741941 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:13.281565905 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:13.281725883 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:13.515991926 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:15.048954964 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:15.100905895 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:15.283996105 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:15.286241055 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:15.578625917 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:15.578768015 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:15.882134914 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:15.890912056 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:16.065443039 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:18.597678900 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:18.837869883 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:18.837960005 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:19.056526899 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:19.100842953 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:19.288655996 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:19.290792942 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:19.539935112 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:19.540052891 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:19.789983034 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:24.366885900 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:24.594178915 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:24.594263077 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:24.828778982 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:26.754745960 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:26.803972960 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:26.990638971 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:27.038326979 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:27.648298979 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:27.902826071 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:27.902987003 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:28.150504112 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:28.505230904 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:28.554006100 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:28.741122007 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:28.742976904 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:28.993191957 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:28.993324995 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:29.254582882 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:34.731126070 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:34.776520014 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:34.964773893 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:34.966342926 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:35.203753948 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:35.203833103 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:35.440563917 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:35.695420980 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:35.922688961 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:35.922749996 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:36.156830072 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:36.711507082 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:36.961843967 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:36.962064028 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:37.082447052 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:37.132102966 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:37.211911917 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:37.315584898 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:37.317244053 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:37.547450066 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:37.547516108 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:37.585675955 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:37.632107973 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:37.781733990 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:37.818809032 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:37.820363045 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:38.076374054 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:38.076498985 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:38.321727991 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:45.773571014 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:46.025513887 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:46.025620937 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:46.215862989 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:46.272773981 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:46.459629059 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:46.461805105 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:46.712037086 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:46.712224960 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:46.962075949 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:47.023845911 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:47.335242033 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:47.344357014 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:47.344414949 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:47.518635988 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:47.527657032 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:49.679398060 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:49.726041079 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:49.909497023 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:49.911391020 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:50.225900888 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:50.235930920 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:50.236073971 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:50.409449100 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:50.419291019 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:53.945239067 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:54.196381092 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:54.200524092 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:54.388793945 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:54.429054022 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:54.538959026 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:54.616065979 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:54.616504908 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:54.790148973 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:54.790426970 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:54.804482937 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:54.804605961 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:54.977045059 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:54.979120016 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:55.227572918 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:55.227626085 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:55.477490902 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:57.072133064 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:57.116511106 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:57.303164005 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:26:57.350872040 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:26:58.351389885 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:58.581545115 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:26:58.581650972 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:26:58.813030005 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:01.184336901 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:01.225879908 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:01.409989119 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:01.411551952 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:01.491925955 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:01.640959024 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:01.641028881 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:01.743170977 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:01.743227005 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:01.875401020 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:01.931868076 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:01.975881100 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:02.165205956 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:02.167021990 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:02.419653893 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:02.420125008 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:02.665103912 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:09.679445982 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:09.991508007 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:10.066714048 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:10.066768885 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:10.174802065 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:10.250951052 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:10.554308891 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:10.664787054 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:10.710253000 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:10.805968046 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:10.806034088 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:10.893588066 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:10.895150900 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:10.997030973 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:11.038393974 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:11.172348976 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:11.172799110 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:11.225050926 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:11.235533953 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:11.476545095 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:11.477790117 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:11.478180885 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:11.563179016 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:11.660135031 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:11.728566885 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:11.728739977 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:11.977843046 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:11.981832981 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:12.040527105 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:12.227272987 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:12.230001926 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:12.477775097 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:12.477854967 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:12.727993965 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:15.384520054 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:15.633869886 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:15.634270906 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:15.826637030 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:15.866518021 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:15.976530075 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:16.053277969 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:16.053457975 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:16.227674007 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:16.227721930 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:16.246361017 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:16.288404942 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:16.414577007 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:16.416836023 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:16.665292025 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:16.665349960 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:16.915254116 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:18.507807970 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:18.759069920 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:18.759161949 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:18.949393988 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:18.991545916 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:19.178375959 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:19.180406094 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:19.430690050 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:19.431030989 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:19.680732012 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:21.007574081 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:21.234944105 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:21.235734940 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:21.469449997 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:21.628492117 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:21.679037094 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:21.862255096 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:21.866560936 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:22.094024897 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:22.094126940 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:22.328913927 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:26.731503010 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:26.772785902 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:26.959656000 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:27.007181883 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:27.570909023 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:27.821327925 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:27.821403980 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:28.009948969 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:28.054851055 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:28.241875887 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:28.244549990 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:28.493393898 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:28.493483067 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:28.743402958 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:32.335788965 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:32.563330889 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:32.563405991 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:32.797422886 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:36.783256054 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:37.024743080 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:37.024811029 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:37.216001987 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:37.272897005 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:37.459736109 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:37.474751949 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:37.712091923 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:37.712650061 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:37.962074041 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:40.877741098 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:40.929044962 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:41.112313032 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:41.113972902 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:41.344305992 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:41.346658945 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:41.579823017 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:43.663969040 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:43.891709089 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:43.891834021 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:44.126162052 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:44.399724960 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:44.444675922 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:44.628070116 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:44.630232096 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:44.860099077 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:44.860171080 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:45.110074997 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:45.836455107 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:46.087088108 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:46.088093042 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:46.276597977 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:46.372767925 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:46.559529066 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:46.561784983 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:46.808631897 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:46.808698893 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:47.056118011 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:54.898683071 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:54.992387056 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:55.153414965 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:55.153469086 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:55.223161936 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:55.223206997 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:55.342015028 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:55.382253885 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:55.453738928 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:55.569112062 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:55.570729017 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:55.821464062 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:55.821692944 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:56.071669102 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:56.650377035 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:56.732146025 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:56.732201099 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:56.837050915 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:56.882168055 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:56.977708101 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:57.068908930 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:57.071208000 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:57.321583986 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:57.321702003 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:27:57.404333115 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:57.444669008 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:57.571594000 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:27:57.628840923 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:57.630711079 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:57.859863043 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:27:57.860646963 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:27:58.094152927 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:03.945523024 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:04.196444988 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:04.196546078 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:04.384999990 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:04.429055929 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:04.615622997 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:04.623740911 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:04.868273020 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:04.868315935 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:05.120268106 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:06.320188046 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:06.547430992 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:06.547488928 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:06.781686068 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:11.251032114 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:11.304059029 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:11.487251997 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:11.490115881 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:11.719604015 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:11.719681025 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:11.953551054 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:13.007632971 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:13.258961916 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:13.259036064 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:13.508837938 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:13.828571081 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:13.882205963 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:14.068717957 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:14.102632046 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:14.352796078 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:14.360574007 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:14.602657080 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:17.650388002 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:17.875422001 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:17.875495911 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:18.109899998 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:22.070281029 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:22.321471930 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:22.324609041 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:22.535707951 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:22.588572979 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:22.776012897 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:22.780572891 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:23.024637938 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:23.028650999 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:23.274606943 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:26.760409117 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:26.804231882 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:26.990897894 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:27.038463116 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:28.976310968 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:29.204320908 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:29.211749077 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:29.438349962 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:31.133384943 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:31.384490013 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:31.384562969 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:31.576913118 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:31.679069996 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:31.869853020 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:31.871439934 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:32.118314028 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:32.118372917 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:32.368324041 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:32.368587971 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:32.562299967 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:32.679070950 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:32.865720034 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:32.867703915 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:33.118230104 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:33.118294954 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:33.368453026 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:38.412455082 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:38.460330009 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:38.643471956 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:38.645225048 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:38.875412941 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:38.875473022 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:39.110107899 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:40.304801941 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:40.531960011 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:40.532026052 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:40.766303062 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:41.335761070 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:41.587291956 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:41.591312885 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:41.782633066 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:41.835468054 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:41.891880989 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:41.944948912 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:42.022135973 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:42.026807070 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:42.128304958 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:42.134856939 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:42.275177956 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:42.280616045 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:42.359801054 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:42.359858036 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:42.524667025 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:42.594577074 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:50.398577929 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:50.649650097 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:50.649949074 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:50.838674068 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:50.838941097 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:51.025918007 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:51.027842999 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:51.218343019 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:51.218518972 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:51.462177992 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:51.464242935 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:51.632927895 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:51.712080956 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:51.860106945 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:51.860174894 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:52.094208956 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:52.898513079 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:52.944713116 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:53.128411055 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:53.130474091 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:53.360671997 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:53.364653111 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:28:53.594579935 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:28:57.103425026 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:57.147978067 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:57.334743977 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:57.384589911 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:59.526273012 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:59.774769068 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:28:59.774976969 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:28:59.963265896 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:29:00.008575916 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:29:00.195580959 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:29:00.200575113 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:29:00.446631908 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:29:00.446732044 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:29:00.700663090 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:29:02.961009026 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:29:02.992235899 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:29:03.188330889 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:29:03.188410044 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:29:03.243308067 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:29:03.243415117 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:29:03.422741890 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:29:03.435689926 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:29:03.604681015 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:29:03.747498989 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:29:03.747816086 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:29:03.748538017 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:29:03.795749903 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:29:03.796000004 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:29:03.997875929 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:29:03.998059988 CET	49716	1339	192.168.2.8	185.196.11.223
Mar 28, 2024 16:29:04.243536949 CET	1339	49716	185.196.11.223	192.168.2.8
Mar 28, 2024 16:29:05.215014935 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:29:05.257246971 CET	49711	4449	192.168.2.8	94.156.66.112
Mar 28, 2024 16:29:05.440727949 CET	4449	49711	94.156.66.112	192.168.2.8
Mar 28, 2024 16:29:05.491605997 CET	49711	4449	192.168.2.8	94.156.66.112

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 16:25:02.214812994 CET	56007	53	192.168.2.8	1.1.1.1
Mar 28, 2024 16:25:03.210558891 CET	56007	53	192.168.2.8	1.1.1.1
Mar 28, 2024 16:25:03.610177994 CET	53	56007	1.1.1.1	192.168.2.8
Mar 28, 2024 16:25:13.509314060 CET	53066	53	192.168.2.8	1.1.1.1
Mar 28, 2024 16:25:13.701056004 CET	53	53066	1.1.1.1	192.168.2.8
Mar 28, 2024 16:25:30.521038055 CET	61189	53	192.168.2.8	1.1.1.1
Mar 28, 2024 16:25:30.617383957 CET	53	61189	1.1.1.1	192.168.2.8
Mar 28, 2024 16:25:30.849320889 CET	61941	53	192.168.2.8	1.1.1.1
Mar 28, 2024 16:25:31.268229961 CET	53	61941	1.1.1.1	192.168.2.8
Mar 28, 2024 16:25:31.853373051 CET	53508	53	192.168.2.8	1.1.1.1
Mar 28, 2024 16:25:31.958045959 CET	53	53508	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 28, 2024 16:25:02.214812994 CET	192.168.2.8	1.1.1.1	0x3b02	Standard query (0)	blue.o7lab.me	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:03.210558891 CET	192.168.2.8	1.1.1.1	0x3b02	Standard query (0)	blue.o7lab.me	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:13.509314060 CET	192.168.2.8	1.1.1.1	0x5b33	Standard query (0)	leetboy.dynuddns.net	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:30.521038055 CET	192.168.2.8	1.1.1.1	0x75c8	Standard query (0)	rentry.co	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:30.849320889 CET	192.168.2.8	1.1.1.1	0x5f04	Standard query (0)	cosmicdust.zip	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:31.853373051 CET	192.168.2.8	1.1.1.1	0x39ef	Standard query (0)	cosmoplanets.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 28, 2024 16:25:02.323754072 CET	1.1.1.1	192.168.2.8	0x1b71	No error (0)	windowsupdatebg.s.llnwi.net	69.164.0.0	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:03.610177994 CET	1.1.1.1	192.168.2.8	0x3b02	No error (0)	blue.o7lab.me	94.156.66.112	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:13.701056004 CET	1.1.1.1	192.168.2.8	0x5b33	No error (0)	leetboy.dynuddns.net	185.196.11.223	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:30.617383957 CET	1.1.1.1	192.168.2.8	0x75c8	No error (0)	rentry.co	104.21.95.148	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:30.617383957 CET	1.1.1.1	192.168.2.8	0x75c8	No error (0)	rentry.co	172.67.145.129	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:31.268229961 CET	1.1.1.1	192.168.2.8	0x5f04	No error (0)	cosmicdust.zip	192.236.232.25	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:31.958045959 CET	1.1.1.1	192.168.2.8	0x39ef	No error (0)	cosmoplanets.net	172.67.142.111	A (IP address)	IN (0x0001)	false
Mar 28, 2024 16:25:31.958045959 CET	1.1.1.1	192.168.2.8	0x39ef	No error (0)	cosmoplanets.net	104.21.71.28	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	16:24:55
Start date:	28/03/2024
Path:	C:\Users\user\Desktop\Sldl84wxy8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Sldl84wxy8.exe"
Imagebase:	0x400000
File size:	66'234'368 bytes
MD5 hash:	0B459466E3619D2A29BB93EA2DAC077A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:24:56
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\Temp\svchost (3).exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\svchost (3).exe"
Imagebase:	0x2422f750000
File size:	452'920 bytes
MD5 hash:	8CD2675E19A8B1DCCF0DBF082F42AB33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.1507763481.0000024231491000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:24:57
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Imagebase:	0x580000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	16:24:57
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Imagebase:
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:24:58
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\Temp\build.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\build.exe"
Imagebase:	0x400000
File size:	65'711'823 bytes
MD5 hash:	8701FCD188315FA69245FB99E07DF60D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs Detection: 15%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:24:58
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6728 -s 1172
Imagebase:	0x7ff6516d0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:24:58
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\Temp\start.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\start.exe"
Imagebase:	0x250000
File size:	64'512 bytes
MD5 hash:	C1ADE258F05C512E98EBC4D9D1165F8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 0000000A.00000002.1498443006.0000000002451000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000A.00000002.1498443006.0000000002451000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 0000000A.00000000.1435545811.0000000000252000.00000002.00000001.01000000.0000000C.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 0000000A.00000002.1498443006.0000000002589000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000A.00000002.1497624420.0000000000866000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\start.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\start.exe, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\start.exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\Temp\start.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:25:04
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:25:04
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:25:04
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpC5CE.tmp.bat""
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:25:04
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:25:04
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"'
Imagebase:	0x920000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:25:04
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 3
Imagebase:	0x470000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:25:05
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Roaming\svchos.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\svchos.exe
Imagebase:	0xbf0000
File size:	64'512 bytes
MD5 hash:	C1ADE258F05C512E98EBC4D9D1165F8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000012.00000002.1617321490.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000012.00000002.1605842437.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\svchos.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:25:07
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Roaming\svchos.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\svchos.exe"
Imagebase:	0xd40000
File size:	64'512 bytes
MD5 hash:	C1ADE258F05C512E98EBC4D9D1165F8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	16:25:25
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
Imagebase:	0x7ff650e10000
File size:	162'036'224 bytes
MD5 hash:	94F3E2F32CED13FD99CC314BEB587233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 1%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:25:30
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Imagebase:	0x7ff650e10000
File size:	162'036'224 bytes
MD5 hash:	94F3E2F32CED13FD99CC314BEB587233
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:25:31
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\main" --mojo-platform-channel-handle=2140 --field-trial-handle=1804,i,13840549230161023294,8166055529436649355,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Imagebase:	0x7ff650e10000
File size:	162'036'224 bytes
MD5 hash:	94F3E2F32CED13FD99CC314BEB587233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	78.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	10
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040108C Relevance: 7.7, Strings: 6, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"OFV, xrefs: 004010CE
6 @, xrefs: 004010BE
& @, xrefs: 004010B6
oG, xrefs: 004010C6
~G, xrefs: 004010D6
! @, xrefs: 004010AE

Memory Dump Source

Source File: 00000001.00000002.1436607192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1436588603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1436643474.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Sldl84wxy8.jbxd

Similarity

API ID:
String ID: ! @$"OFV$& @$6 @$oG$~G
API String ID: 0-3229304534
Opcode ID: 5174a14591ca635f1db87a6d4c67c05b4f91bfe44911202448a0cdc777819ef2
Instruction ID: e724ad2ff7e05f40d7e960fad95cd34ab1c04117f2f6ff20a09d1085715ad7e9
Opcode Fuzzy Hash: 5174a14591ca635f1db87a6d4c67c05b4f91bfe44911202448a0cdc777819ef2
Instruction Fuzzy Hash: 52810EF0E001049BEB54DBACCC41B9DB7A9EB49304F14417EE509FB391E639AE44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 1.3, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@:/:d0&n54[l0f8_[atjp55hu,ia^r4j, xrefs: 0040106E

Memory Dump Source

Source File: 00000001.00000002.1436607192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1436588603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1436643474.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Sldl84wxy8.jbxd

Similarity

API ID:
String ID: @:/:d0&n54[l0f8_[atjp55hu,ia^r4j
API String ID: 0-1982255172
Opcode ID: 6ad473e3d7fe9158c1acde196af2d92c49358fc5d47a9cc217abf66bd194a4d8
Instruction ID: 01b69ddd6a7163423e12e5d848ef507565a3d8b94cc01782238194285892dabd
Opcode Fuzzy Hash: 6ad473e3d7fe9158c1acde196af2d92c49358fc5d47a9cc217abf66bd194a4d8
Instruction Fuzzy Hash: AF110C74A05248EFCB04CFACD4907ADBBF1AF49308F1480AAE856E7391D635AE41DB45

Uniqueness

Uniqueness Score: -1.00%

Function 004014AD Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1436607192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1436588603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1436643474.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Sldl84wxy8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0371ddca023962616af75c2a0edfdb9946b4d8cfbb078e5fe1312eb7fd1036
Instruction ID: 80ae2145c01ed9a0bd9e54fa606dc6f9d2ae6a338a5152521c4b02b2529d83df
Opcode Fuzzy Hash: bd0371ddca023962616af75c2a0edfdb9946b4d8cfbb078e5fe1312eb7fd1036
Instruction Fuzzy Hash: 9E110CF5A00104ABCB10EAA9DD85F6A73ACEB4C304F244479F904E7351E63AFE448B65

Uniqueness

Uniqueness Score: -1.00%

Function 00401437 Relevance: .0, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1436607192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1436588603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1436643474.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Sldl84wxy8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ceb93a99ebeec00306d6dd528dc86c519ae1ceeff220e1f2ccaca6cd38c1938
Instruction ID: 258f5bda1751a64d6318511c264ffd85ec2ee89db4ba185bd8ea99de01385903
Opcode Fuzzy Hash: 0ceb93a99ebeec00306d6dd528dc86c519ae1ceeff220e1f2ccaca6cd38c1938
Instruction Fuzzy Hash: 90F07A75A00209AFCB40DFA9D5C1D59B7FCAB4C304F105069F954D7751D635FA448B54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost (3).exePID: 6728, Parent PID: 6360COMMON

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4B140F69 Relevance: 10.4, Strings: 7, Instructions: 1678COMMON

Download Yara Rule

Strings

x6CA, xrefs: 00007FFB4B141D39
x6CA, xrefs: 00007FFB4B141C29
XCA, xrefs: 00007FFB4B141E63
XCA, xrefs: 00007FFB4B141DC8
,M_H, xrefs: 00007FFB4B1410D2
XCA, xrefs: 00007FFB4B141DF5
XCA, xrefs: 00007FFB4B141D77

Memory Dump Source

Source File: 00000002.00000002.1512825721.00007FFB4B130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b130000_svchost (3).jbxd

Similarity

API ID:
String ID: ,M_H$XCA$XCA$XCA$XCA$x6CA$x6CA
API String ID: 0-3177249968
Opcode ID: c60fbdfcf4e25aad1de3e78cd8ee2bd1be66d12e3fc763c6a0b8c17601eba676
Instruction ID: c3093c6ea87385882f0d0df84411085c88c231356085b0780585e9260869c878
Opcode Fuzzy Hash: c60fbdfcf4e25aad1de3e78cd8ee2bd1be66d12e3fc763c6a0b8c17601eba676
Instruction Fuzzy Hash: 73B2567161CB594FE349EF38C4814B5BBE2FF85305B1485BED48AC72A6DA34E852CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B13E3E1 Relevance: 2.7, Strings: 1, Instructions: 1447COMMON

Download Yara Rule

Strings

#PM, xrefs: 00007FFB4B13EED7

Memory Dump Source

Source File: 00000002.00000002.1512825721.00007FFB4B130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b130000_svchost (3).jbxd

Similarity

API ID:
String ID: #PM
API String ID: 0-2743245238
Opcode ID: d3b50332f28bfe987601cf96eb0b97960b40f0162fcfbe996ee9bb61a4e6be97
Instruction ID: 7b20bd5a88bd21d49eb79c496dd1e0b1517cbbb16f7750576fe9d11d88fc1b71
Opcode Fuzzy Hash: d3b50332f28bfe987601cf96eb0b97960b40f0162fcfbe996ee9bb61a4e6be97
Instruction Fuzzy Hash: 0BA2497251CB498FF759EF38C4844A5B7E1FF85304B1489BED48AC72A6EE34A846CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B13B630 Relevance: 2.2, Strings: 1, Instructions: 929COMMON

Download Yara Rule

Strings

@8CA, xrefs: 00007FFB4B13FB9E

Memory Dump Source

Source File: 00000002.00000002.1512825721.00007FFB4B130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b130000_svchost (3).jbxd

Similarity

API ID:
String ID: @8CA
API String ID: 0-1252482761
Opcode ID: a0659734e3d56d42e20ea5e28b23d02b5fcf21944b629e755b2aca60d7944999
Instruction ID: fed023831047de154bef745c370edb684f903e753f9dead7da8fcc23dcd84739
Opcode Fuzzy Hash: a0659734e3d56d42e20ea5e28b23d02b5fcf21944b629e755b2aca60d7944999
Instruction Fuzzy Hash: 8852E771A1CA098FEB68EF38C455A7977E1FF59305F1441BDE44EC72A2EE24AC428B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B1402C0 Relevance: 2.0, Strings: 1, Instructions: 716COMMON

Download Yara Rule

Strings

x6CA, xrefs: 00007FFB4B140BD6

Memory Dump Source

Source File: 00000002.00000002.1512825721.00007FFB4B130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b130000_svchost (3).jbxd

Similarity

API ID:
String ID: x6CA
API String ID: 0-1973855117
Opcode ID: 9c2dd44e195230682cf99924014b46a57a3597cffece9c5bcb5fae6a5cbdf430
Instruction ID: 0526d78fa8690647c92b0ef63a38e6b7702586edae001a074146cae34d561594
Opcode Fuzzy Hash: 9c2dd44e195230682cf99924014b46a57a3597cffece9c5bcb5fae6a5cbdf430
Instruction Fuzzy Hash: DD2278B2E2DA5A4FF39CEE39C4591753BD1EF94304B1481BED48DC71A3DD18A8068B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B13DF59 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1512825721.00007FFB4B130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b130000_svchost (3).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da637780793265a6a5ec359d47061d103a7b4d20b034499315bf5979fe8a9518
Instruction ID: 6f4f8e62fb5ee17c6619ceb29c15d70018f15a12ecd1244508b5ad17f0f09463
Opcode Fuzzy Hash: da637780793265a6a5ec359d47061d103a7b4d20b034499315bf5979fe8a9518
Instruction Fuzzy Hash: 37E1597261CB4A4FF319DB34C4911B577D2FF95305B148A7ED4CAC72A1EE28A806CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B23026B Relevance: 2.4, Strings: 1, Instructions: 1144COMMON

Download Yara Rule

Strings

A, xrefs: 00007FFB4B230786

Memory Dump Source

Source File: 00000002.00000002.1513444536.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b230000_svchost (3).jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: cb05cef6823527af2df9d7b07a1e441e288cc44c9ad1a1ed197d71a7f905fc3d
Instruction ID: 267dbd17e83f336c6948a69dd196c72b622fd3897647c3b7a455cdcc05dbdec3
Opcode Fuzzy Hash: cb05cef6823527af2df9d7b07a1e441e288cc44c9ad1a1ed197d71a7f905fc3d
Instruction Fuzzy Hash: D57208B380D6C54FE756FF38C8956A5BFE0EF56300F0986FAD1898B0A3D9286806C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B133AA5 Relevance: 1.6, APIs: 1, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFB4B133B5D

Memory Dump Source

Source File: 00000002.00000002.1512825721.00007FFB4B130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b130000_svchost (3).jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 83c69218073ce071cfc42a8833a9c73bd63ea51b214ea36131dc05696995bb44
Instruction ID: 14952d4fff85cf220d68b2dd31cd57e4a760f013cc03bc58a3c22b4f443dab4b
Opcode Fuzzy Hash: 83c69218073ce071cfc42a8833a9c73bd63ea51b214ea36131dc05696995bb44
Instruction Fuzzy Hash: 7831F57191C74C8FDB199FAC98465F97BE0EB95321F04436FE089C3192DA7468068B96

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230E29 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1513444536.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b230000_svchost (3).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4318607e7d3fc190f22414dced522267b92e9880672c053aa5c27f5ad1596141
Instruction ID: 1a796d611a0ad03854910c0003d20dc84327ad29afaec937fac3b22884bea33c
Opcode Fuzzy Hash: 4318607e7d3fc190f22414dced522267b92e9880672c053aa5c27f5ad1596141
Instruction Fuzzy Hash: DC613A7250D6C94FD746FF34C8656F6BFA0EF56300B0985EAD089CB4A3CE29A806C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230D71 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1513444536.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b230000_svchost (3).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189f5d3fb67431359bb5b07404ca19fc3087f0e7c8a430b6202a9a8f161e2e48
Instruction ID: a14e16e6d1b98be6c8492f04e14dde2789e46efaa8017581f32b37765893a88b
Opcode Fuzzy Hash: 189f5d3fb67431359bb5b07404ca19fc3087f0e7c8a430b6202a9a8f161e2e48
Instruction Fuzzy Hash: 11319E9291E7C50FD307AB7948652A5BFA0EFA7120B4E95EBC0C5CB4E3D40D28078362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230A04 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1513444536.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b230000_svchost (3).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218a0dea68f86113e214a7dd71e14ec30ddf5a5aae61fe377008497203541354
Instruction ID: 55b5ae3ba9056c2c40d9a5eee21554f54138f6e02ef08989f075328333bddaf6
Opcode Fuzzy Hash: 218a0dea68f86113e214a7dd71e14ec30ddf5a5aae61fe377008497203541354
Instruction Fuzzy Hash: C6E01230A1462DCEDF64EB18DC81BE9B3B1FB89300F0041E6D54DA3251CA306A84CF52

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: start.exePID: 5652, Parent PID: 6360COMMON

Executed Functions

Function 02240F80 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

d.t, xrefs: 02240FCD

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID: d.t
API String ID: 0-955178627
Opcode ID: cdae9c4024ac53920241f0d578f7c96854e7315f0965b6ba52aa9f0f9f5181c0
Instruction ID: 0a20247130198677deb3fe78e51f1660a0613b384960c0908e21f335f2541ba4
Opcode Fuzzy Hash: cdae9c4024ac53920241f0d578f7c96854e7315f0965b6ba52aa9f0f9f5181c0
Instruction Fuzzy Hash: E151A070B105148FD708DFA9C858B5EBBF2AF89700F2580AAE905DB3A5CB74DD418B81

Uniqueness

Uniqueness Score: -1.00%

Function 02241AB4 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4159561a8759b1892869428ddcabc2313f6c8d9e2d70b4ab10d9115922a44cc8
Instruction ID: 36c199641e2d88edf88b7e8e92554dc7e506bc723201598073355ce433a49d35
Opcode Fuzzy Hash: 4159561a8759b1892869428ddcabc2313f6c8d9e2d70b4ab10d9115922a44cc8
Instruction Fuzzy Hash: 76C10734B10205CFDB08EFB8D454AADB7F2AF88714B214469E906AB3A5CF75DC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02242159 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13540cd33f2d20c5e616df49dc50b32e293f3dd1f4f7281ae02b15fd9c5ae4e9
Instruction ID: 70120f769541884aee2e6bcda1c4d9440c845409d1d0a20ec8691f7a25d600b0
Opcode Fuzzy Hash: 13540cd33f2d20c5e616df49dc50b32e293f3dd1f4f7281ae02b15fd9c5ae4e9
Instruction Fuzzy Hash: 50E09A2170D2E48FC302A7B8A82985A3FA58F87200B1D00FAD189CF3B3C919AC018392

Uniqueness

Uniqueness Score: -1.00%

Function 02241CCC Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39fe3d7055ccb12e130553a47db4d459e258fd7ed6780ac2e53707524c83e142
Instruction ID: 402a42244a36c615883f66a41de8d014070bf5534c59a4f99b2555e9fc3e14b1
Opcode Fuzzy Hash: 39fe3d7055ccb12e130553a47db4d459e258fd7ed6780ac2e53707524c83e142
Instruction Fuzzy Hash: E4610938710205CFDB48EFA8D494A6D77F2BF88714B214499E906AB3A6CF71EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02240DE8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c8553cd2c33ec5645e242042a05e82a0cc320a13e4161f5a03b757663588df3
Instruction ID: 1341e4dfbb07b298fa29bfd3a661615d5df2937eb0e4088aa8896105c34b6d38
Opcode Fuzzy Hash: 0c8553cd2c33ec5645e242042a05e82a0cc320a13e4161f5a03b757663588df3
Instruction Fuzzy Hash: 7941A271B042048FDB19DB69D458BAEBBF2BF89200F1445A9E106EB3A2CF759D45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02240B49 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea56c4a2d8724b964ecbebc0f3fb7e23f0ec51d0d520755930c450b78010cde
Instruction ID: e84e92c6077c27c559eeb5d46dd5069d1c56e82283032cc8e4f79e325b1ed7bb
Opcode Fuzzy Hash: 2ea56c4a2d8724b964ecbebc0f3fb7e23f0ec51d0d520755930c450b78010cde
Instruction Fuzzy Hash: A1510E38901309DFD787FF74F854A9A37A2FB843957106568D002AF26AEB31D946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02241298 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2c5addd068fa98e0c876bbc32ee5b68802939a8b50e1b0b4c4a4d4bf40718e
Instruction ID: 43d868d0d16f2a869ed216fafacfdb839e2dd4ec7188485420e17a5bb8b397f9
Opcode Fuzzy Hash: 6b2c5addd068fa98e0c876bbc32ee5b68802939a8b50e1b0b4c4a4d4bf40718e
Instruction Fuzzy Hash: 5F417F70E04259AFCB08DBFD84546AEBBF6EFC8700F20816AD54AD7745DF3499418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 022409A8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4153387d4c349de4e591375ec7122255f33ab85b4c5606ecfe12ea8b5ff5637
Instruction ID: ed6b0dbcc2525a293cd37f24e8d7e63a20cd329b8b183fd6a881a71309cc0730
Opcode Fuzzy Hash: c4153387d4c349de4e591375ec7122255f33ab85b4c5606ecfe12ea8b5ff5637
Instruction Fuzzy Hash: 6B41C1306206168BDB9DAFB5982433F36E1BF44644B04592EC647DB244EF38CA80CF61

Uniqueness

Uniqueness Score: -1.00%

Function 022409B8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6e07d02be9909bf30808aa1986d894e3deeacc8a2e5ee87cf8d823b0ee69dc
Instruction ID: 7597663b0c43b887cfc58d74e781f2ed4567286c45ad267e257af228d5f87aa2
Opcode Fuzzy Hash: df6e07d02be9909bf30808aa1986d894e3deeacc8a2e5ee87cf8d823b0ee69dc
Instruction Fuzzy Hash: 44319130620616CBDB5DAFF9982463F76E5BF84644704592EC647DB244EF24DA80CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02241402 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ddd0335cecbe4efcfef91ca4ba13cbacda24a81977a893696c05868a67ced50
Instruction ID: 8595982adbedcfdbbf55f3cdfff4221f319474ebffde5fd6e69d8cedb3d9125c
Opcode Fuzzy Hash: 7ddd0335cecbe4efcfef91ca4ba13cbacda24a81977a893696c05868a67ced50
Instruction Fuzzy Hash: 5031A074B012168FCB04DBB98891A6E7BF2AF89600B14406EE509DB355DF75DD418790

Uniqueness

Uniqueness Score: -1.00%

Function 02240DE0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd7e7b824f6bbfb3a0eb67a3e62a38b0bbedcda6ae32c8ac9756baebc5c6413
Instruction ID: 52fa38c6c2afd62ec6d5d7e523811759c85abdeeb8bf6bdb80d0ebfe0df7fc83
Opcode Fuzzy Hash: fbd7e7b824f6bbfb3a0eb67a3e62a38b0bbedcda6ae32c8ac9756baebc5c6413
Instruction Fuzzy Hash: D1319E35A10209CFDB19DFA8C458BAEBBF2BF88300F148569E501AB3A1CB759D45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 022410F8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05b4e58a7d7c5899ae8782592acab73e21031311041ee5849b137ffcd839b9a
Instruction ID: b16f3b6a5cdf4af3d663b9aff5080a0326e7ee0c34d8938e93c57cc087512a16
Opcode Fuzzy Hash: d05b4e58a7d7c5899ae8782592acab73e21031311041ee5849b137ffcd839b9a
Instruction Fuzzy Hash: 27215E34B105088FE718DBA4D554BAE7BF2BF88710F248155E909AB3B9DFB09C41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 022414F9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d88e5f87e04988f620bb5bfe6433d898f24b71a73005141af240ce570861e6e
Instruction ID: 5efb16d0e98e79479ca59ff7e8e390745c516b3cd68f18e3b34776d5676b15ed
Opcode Fuzzy Hash: 9d88e5f87e04988f620bb5bfe6433d898f24b71a73005141af240ce570861e6e
Instruction Fuzzy Hash: 4A11C274B00202CFCB55EFB895486AA7BF2EF88244710487DD40AEB35ADB32CC52CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02241508 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8705d34370789b3ea9af7a1e2e13ea5dcdc3333f58788e3c9fa107583f47318
Instruction ID: b1026d5dce47914af5590ffaa0602ce7a02eb3329c019bd1f94bf2030c23687b
Opcode Fuzzy Hash: c8705d34370789b3ea9af7a1e2e13ea5dcdc3333f58788e3c9fa107583f47318
Instruction Fuzzy Hash: 1E11A130B00205CFCB59EFB9D90866A7BE6AF882407104479D40BEB359EF31CC91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02240F07 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01dfd8a2b256357908f3fee4e4684c8c198136edd7f13e4b949581cd02a0b060
Instruction ID: 75cbd479177d24cb6ef2b76683f32b873dfd265bb640f99c590cb2b6dbca7a02
Opcode Fuzzy Hash: 01dfd8a2b256357908f3fee4e4684c8c198136edd7f13e4b949581cd02a0b060
Instruction Fuzzy Hash: E2F0C86170D2804FD78A6739686476E3FE39FC615071548FAE14ADB393DD698C0A8351

Uniqueness

Uniqueness Score: -1.00%

Function 02240F48 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad98c80d9e1eee81e1dbecd03c08641d02435c125fb5560b712d465c5055d5b5
Instruction ID: f53ae28f8626d41baed59c049f6ccb95556a31252e9225f1500c47f6fd64f0b7
Opcode Fuzzy Hash: ad98c80d9e1eee81e1dbecd03c08641d02435c125fb5560b712d465c5055d5b5
Instruction Fuzzy Hash: 89E08C313001018F87489A2EB88886BBBDAEBC8560315087AE109C7322CE61CC018690

Uniqueness

Uniqueness Score: -1.00%

Function 02241FB5 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d95bec0477cc3934780c01075ddbc1c37c564fe21d4a46b43e3196bbcd593b1e
Instruction ID: 644f17af3e5b1906d2361bb13e6e4bed0faf8c076432c22101d1edd1d9f61250
Opcode Fuzzy Hash: d95bec0477cc3934780c01075ddbc1c37c564fe21d4a46b43e3196bbcd593b1e
Instruction Fuzzy Hash: 98E09B303047958ADB35D2BCD0143EEBBD25F41714F00495DD58657681CFB7B9048392

Uniqueness

Uniqueness Score: -1.00%

Function 02242438 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1498095873.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2240000_start.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0b990cc0a98e9154f3866c9459323f505809112127917eb09ec3c972e43f22
Instruction ID: fe272221f2a2095effe86b41fbc52a6d68b77c0cd3e9f212193dddd4d57d1b75
Opcode Fuzzy Hash: 1e0b990cc0a98e9154f3866c9459323f505809112127917eb09ec3c972e43f22
Instruction Fuzzy Hash: 38D0A7313001189BC600A6FEE44585E37DE9FCA6507540075E105DB751CE25EC0103D5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchos.exePID: 6536, Parent PID: 660COMMON

Executed Functions

Function 01530F80 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

d.t, xrefs: 01530FCD

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID: d.t
API String ID: 0-955178627
Opcode ID: cece742f2f792f846cdc84866d5c0b8b55bc8f95f9a49f4b3dcf16b9ae430b61
Instruction ID: f17d919e21a0ee7e34c06b1cd530325baa869df0aed67cd93e2fc3bb7e125715
Opcode Fuzzy Hash: cece742f2f792f846cdc84866d5c0b8b55bc8f95f9a49f4b3dcf16b9ae430b61
Instruction Fuzzy Hash: 0F519C70B106148FD744DF69D458A6EBBF2FF88700F2181AAE805EB3A5CA71DC018B95

Uniqueness

Uniqueness Score: -1.00%

Function 01530DE8 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d255733a5c7882ba971baac73ca194b93cdeebfeeb9688800984091a7182ec
Instruction ID: 68a0f3621dd13cb5b6f0485288dffd1b04439089350503d07b2ce9a8ba997f46
Opcode Fuzzy Hash: e6d255733a5c7882ba971baac73ca194b93cdeebfeeb9688800984091a7182ec
Instruction Fuzzy Hash: A041EF757002048FDB15DF69D458BAEBBF2FF89200F1485AAE005EB3A1CB759C05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01530B49 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed599babc7200cb48ea348bee0340be411b1ffd9da8e87373bfa8354078d633
Instruction ID: 35a0583cab2e62bdb3a139e754bcb6e9fdcad37955355b5567033fe157ad26e4
Opcode Fuzzy Hash: 6ed599babc7200cb48ea348bee0340be411b1ffd9da8e87373bfa8354078d633
Instruction Fuzzy Hash: 1151D93C10220BDFCB16FF74F4689993772FB95615720466AC4018B22DEB31A96ACF92

Uniqueness

Uniqueness Score: -1.00%

Function 01531298 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76bcbf7f9ad0c5d13f9573a8b883d0b95f3fb124c2d5f48f82c52f36ff9802e
Instruction ID: ddaa80fbbde1d9e9d81749d03c95078d53cd47d957075f821760615e9bce2af6
Opcode Fuzzy Hash: c76bcbf7f9ad0c5d13f9573a8b883d0b95f3fb124c2d5f48f82c52f36ff9802e
Instruction Fuzzy Hash: 3A4191B1E002099FDB44DBBE94446AEBBF6FFC8700F24C56ED40AD7741DA3499418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 015309A8 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a541ae64bf1008c0d1ef61d28aed06c4a1fb8fe62031ea071837a023fd665b8
Instruction ID: 638199b3eb37fbc276c1f96d8bd4734bd20bd7d7828fe6e4b24eed128f4979d9
Opcode Fuzzy Hash: 2a541ae64bf1008c0d1ef61d28aed06c4a1fb8fe62031ea071837a023fd665b8
Instruction Fuzzy Hash: A2416B707013068FDB69AB79A92463E3BE5BFC46047148A2EE447CF294EF70D9028B51

Uniqueness

Uniqueness Score: -1.00%

Function 015309B8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341aab7b5bdc003d8032df69b58b139648b1b3522cf3acdafda7047427fd0612
Instruction ID: 69c24ccb1c8b1e695ef9743dd1a07de0b2b90f32d1e280040f502a614522b478
Opcode Fuzzy Hash: 341aab7b5bdc003d8032df69b58b139648b1b3522cf3acdafda7047427fd0612
Instruction Fuzzy Hash: 84315E30701306CBEB69BFB9A42463E77E5BFD46447144A2EE546CF294EF60C8028B52

Uniqueness

Uniqueness Score: -1.00%

Function 01530DD9 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e250a7871ae6cc2916d914e04753379adc16e36b13494c1f0ec670e2ef9722
Instruction ID: 90e8cda42cf27919d441c53b27ee8842b085963026d733fe9cecae143d5816df
Opcode Fuzzy Hash: c2e250a7871ae6cc2916d914e04753379adc16e36b13494c1f0ec670e2ef9722
Instruction Fuzzy Hash: 5F315E75A003099FDB14DF69D448BAEBBF2FF89700F14856AE401AB3A1CB719D04CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01531402 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32a8b9adcd2e2999ca8fa0012887ee35894fc26e9989ae0bee4dc56bba6b4f7
Instruction ID: 9855c00d8f40db3a12300b8ac55c0bddbae754284ab45a690b1ab980cbd0f5f9
Opcode Fuzzy Hash: e32a8b9adcd2e2999ca8fa0012887ee35894fc26e9989ae0bee4dc56bba6b4f7
Instruction Fuzzy Hash: 3031AE74B012169FDB44EB798891A7EBBF2BFC9600B14807EE505DB395DE35DC018790

Uniqueness

Uniqueness Score: -1.00%

Function 014CD4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1610476406.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_14cd000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3af76b876a0c84d962311dcdf64a2a3fb344e1af043dcd4e5fb01e3e2c72a9
Instruction ID: 28592d0186ccda5790d01df37bd7df8e424cdce5490b9f3bb5914f71debbd384
Opcode Fuzzy Hash: 7b3af76b876a0c84d962311dcdf64a2a3fb344e1af043dcd4e5fb01e3e2c72a9
Instruction Fuzzy Hash: 28212475900204DFDB45DF98D8C0B27BF61FB94718F20C17EE9090A266C336D446CAE2

Uniqueness

Uniqueness Score: -1.00%

Function 015314F9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ddeffbb527cf29536003d7ee43dab701cb4e6e3ec95e5784bdaa2f8fc7a15b
Instruction ID: c71d4b1df80cfada9bf623756c5585a7f54ab37402eeb6fa5a5af8f91ede08d6
Opcode Fuzzy Hash: 98ddeffbb527cf29536003d7ee43dab701cb4e6e3ec95e5784bdaa2f8fc7a15b
Instruction Fuzzy Hash: DC11A034A00205CFCB15EB78D9545AA7BF6EF882107144879D806DB359DB35C811CB90

Uniqueness

Uniqueness Score: -1.00%

Function 014CD49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1610476406.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_14cd000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: 24528100c12359cc793b8702c5e5e9abc55edf4b1cfb1b7677d00118351f4290
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: 9711DF76904240DFCB02CF44D9C0B16BF61FB94324F24C1AED9090B267C336D456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01531508 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762d9de2db78b121c4b9343866dbb7cba733e89252435f6654502325f11df5b5
Instruction ID: 6d80587120a3968b7c7c51064eb06f4223dbd32433a9ae07c6efbc96b23a7854
Opcode Fuzzy Hash: 762d9de2db78b121c4b9343866dbb7cba733e89252435f6654502325f11df5b5
Instruction Fuzzy Hash: 1A118B34B00206DFCB54EBBDD95866A7BE6AF882007144879D407DB398EB31CC51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01530F07 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798f59b936d9963cbc49c32f6c876b2361da2b6dda75cbc114806cf5b4f2b1ef
Instruction ID: f326f0825a50092b83aa314dc5c392d3bc9a0cffcccfe884bd46caa8a271dfcc
Opcode Fuzzy Hash: 798f59b936d9963cbc49c32f6c876b2361da2b6dda75cbc114806cf5b4f2b1ef
Instruction Fuzzy Hash: 26F028203092414FC7865B3954642AE3BE3EFCB16031544FAD149CB366DE798C0A8391

Uniqueness

Uniqueness Score: -1.00%

Function 01530F48 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1613425128.0000000001530000.00000040.00000800.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1530000_svchos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5ea923a5490da18554187b645f3229d898e57578dd5ad9ee28b30f1e497625
Instruction ID: e094d8cf4e7d8b09de02305c052ed25d6adaa653b9ec844a6c24c86e2e6e11fb
Opcode Fuzzy Hash: 7e5ea923a5490da18554187b645f3229d898e57578dd5ad9ee28b30f1e497625
Instruction Fuzzy Hash: 84E0C2313011018F87489A3EB88886BB7EBEFC957031508BAF10DCB325CE71CC018390

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Sldl84wxy8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VenomRAT

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost (3).exe_6122bbe2fa8fede73f613859bbd18b79843c243_1f2af782_88721aa2-c727-47e9-bfe6-32bf9bdb24f2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF87.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB247.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB267.tmp.xml

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\start.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchos.exe.log

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\LICENSE.electron.txt

C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\LICENSES.chromium.html

Windows Analysis Report
Sldl84wxy8.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre