Windows Analysis Report
DVuCnBrdbI.exe

Overview

General Information

Sample name: DVuCnBrdbI.exe
renamed because original name is a hash value
Original sample name: b321fbc4a5947b5e623708e11a166692.exe
Analysis ID: 1431406
MD5: b321fbc4a5947b5e623708e11a166692
SHA1: a47346617fe2b1dda2920a23179daf9b36bbb06e
SHA256: d1396a1ec855bd2cd988d0473161c5fba7ac170ba8e2f31b00d2689b517a0f22
Tags: DCRatexe
Infos:

Detection

DCRat
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Yara detected DCRat
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Drops PE files with benign system names
Drops executable to a common third party application directory
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: DVuCnBrdbI.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\Default\Downloads\upfc.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\Idle.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\3D Objects\WmiPrvSE.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\Registry.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\vgX27OamF2.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Windows\Downloaded Program Files\lsass.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\wininit.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Found malware configuration
Source: 00000000.00000002.1686893087.0000000012F31000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: DCRat {"SCRT": "{\"i\":\"%\",\"6\":\".\",\"b\":\" \",\"0\":\"#\",\"H\":\"&\",\"9\":\"-\",\"v\":\")\",\"S\":\"(\",\"d\":\"~\",\"m\":\"@\",\"L\":\",\",\"W\":\"_\",\"N\":\">\",\"5\":\"$\",\"A\":\"^\",\"Z\":\";\",\"C\":\"*\",\"y\":\"`\",\"I\":\"|\",\"e\":\"!\",\"J\":\"<\"}", "PCRT": "{\"D\":\"*\",\"E\":\"(\",\"Q\":\"<\",\"U\":\"^\",\"R\":\"&\",\"F\":\"-\",\"0\":\"@\",\"V\":\"%\",\"1\":\",\",\"I\":\"$\",\"W\":\"_\",\"j\":\";\",\"Z\":\">\",\"n\":\")\",\"v\":\"!\",\"d\":\"|\",\"p\":\"`\",\"w\":\" \",\"J\":\".\",\"B\":\"#\",\"N\":\"~\"}", "TAG": "", "MUTEX": "shddsfhdsfhsdfhdsfuidshfkjdshhjodsghdshfjklsdhfljkdshkjldsfhglskdhglfsdjkhgldshglsdfjhgldjfhdlhnvudfhgkldjfhgkjldfshglkfdhgjkdfhvdkghkdfjhgsldfkhgidsfhggggjrbufdngvklhgkdfhgs", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false, "H1": "http://golovkcc.beget.tech/@==gbJBzYuFDT", "H2": "http://golovkcc.beget.tech/@==gbJBzYuFDT", "T": "0"}
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe ReversingLabs: Detection: 81%
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\Idle.exe ReversingLabs: Detection: 81%
Source: C:\Program Files\Common Files\qJBfikDNRbrkF.exe ReversingLabs: Detection: 81%
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe ReversingLabs: Detection: 81%
Source: C:\Program Files\Windows Mail\qJBfikDNRbrkF.exe ReversingLabs: Detection: 81%
Source: C:\ProgramData\Packages\qJBfikDNRbrkF.exe ReversingLabs: Detection: 81%
Source: C:\Recovery\Registry.exe ReversingLabs: Detection: 81%
Source: C:\Recovery\qJBfikDNRbrkF.exe ReversingLabs: Detection: 81%
Source: C:\Recovery\wininit.exe ReversingLabs: Detection: 81%
Source: C:\Users\Default\Desktop\qJBfikDNRbrkF.exe ReversingLabs: Detection: 81%
Source: C:\Users\Default\Downloads\upfc.exe ReversingLabs: Detection: 81%
Source: C:\Users\user\3D Objects\WmiPrvSE.exe ReversingLabs: Detection: 81%
Source: C:\Windows\Downloaded Program Files\lsass.exe ReversingLabs: Detection: 81%
Source: C:\Windows\SchCache\csrss.exe ReversingLabs: Detection: 81%
Source: C:\Windows\TAPI\WmiPrvSE.exe ReversingLabs: Detection: 81%
Source: C:\Windows\Temp\Crashpad\reports\WmiPrvSE.exe ReversingLabs: Detection: 81%
Multi AV Scanner detection for submitted file
Source: DVuCnBrdbI.exe ReversingLabs: Detection: 81%
Machine Learning detection for dropped file
Source: C:\Users\Default\Downloads\upfc.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\Idle.exe Joe Sandbox ML: detected
Source: C:\Users\user\3D Objects\WmiPrvSE.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Joe Sandbox ML: detected
Source: C:\Recovery\Registry.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Joe Sandbox ML: detected
Source: C:\Windows\Downloaded Program Files\lsass.exe Joe Sandbox ML: detected
Source: C:\Recovery\wininit.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: DVuCnBrdbI.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: DVuCnBrdbI.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Windows Mail\qJBfikDNRbrkF.exe Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Windows Mail\6ed216578b75a5 Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Internet Explorer\6ed216578b75a5 Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Common Files\qJBfikDNRbrkF.exe Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Common Files\6ed216578b75a5 Jump to behavior
Source: DVuCnBrdbI.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user\AppData\Local Jump to behavior

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://golovkcc.beget.tech/@==gbJBzYuFDT
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000003759000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Creates files inside the system directory
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\TAPI\WmiPrvSE.exe Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\TAPI\WmiPrvSE.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\TAPI\24dbde2999530e Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\Downloaded Program Files\lsass.exe Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\Downloaded Program Files\lsass.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\Downloaded Program Files\6203df4a6bafc7 Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\SchCache\csrss.exe Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\SchCache\csrss.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\SchCache\886983d96e3d3e Jump to behavior
PE file contains executable resources (Code or Archives)
Source: DVuCnBrdbI.exe Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: qJBfikDNRbrkF.exe.0.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: WmiPrvSE.exe.0.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: qJBfikDNRbrkF.exe0.0.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: WmiPrvSE.exe0.0.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Sample file is different than original file name gathered from version info
Source: DVuCnBrdbI.exe, 00000000.00000002.1689297652.000000001B920000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilename( vs DVuCnBrdbI.exe
Source: DVuCnBrdbI.exe, 00000000.00000002.1689528002.000000001BEA4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs DVuCnBrdbI.exe
Source: DVuCnBrdbI.exe, 00000000.00000000.1631738070.0000000000D58000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs DVuCnBrdbI.exe
Source: DVuCnBrdbI.exe, 00000000.00000002.1689251818.000000001B900000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilename( vs DVuCnBrdbI.exe
Source: DVuCnBrdbI.exe, 00000000.00000002.1691078613.000000001C486000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs DVuCnBrdbI.exe
Source: DVuCnBrdbI.exe Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs DVuCnBrdbI.exe
Uses 32bit PE files
Source: DVuCnBrdbI.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: DVuCnBrdbI.exe, B3PiA5SFPK5Zw4KAPEo.cs Cryptographic APIs: 'CreateDecryptor'
Source: DVuCnBrdbI.exe, B3PiA5SFPK5Zw4KAPEo.cs Cryptographic APIs: 'CreateDecryptor'
Source: DVuCnBrdbI.exe, KXjbPlwRN4DQenO4GDH.cs Cryptographic APIs: 'TransformBlock'
Source: DVuCnBrdbI.exe, KXjbPlwRN4DQenO4GDH.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal100.troj.evad.winEXE@36/54@0/0
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Program Files\Windows Mail\qJBfikDNRbrkF.exe Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Users\Default\Desktop\qJBfikDNRbrkF.exe Jump to behavior
Source: C:\Windows\TAPI\WmiPrvSE.exe Mutant created: NULL
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\b646ff99111bcf432bf796ccea30e257e4449700
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\Temp\Crashpad\reports\WmiPrvSE.exe Jump to behavior
Source: DVuCnBrdbI.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: DVuCnBrdbI.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: DVuCnBrdbI.exe ReversingLabs: Detection: 81%
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File read: C:\Users\user\Desktop\DVuCnBrdbI.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\DVuCnBrdbI.exe "C:\Users\user\Desktop\DVuCnBrdbI.exe"
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\qJBfikDNRbrkF.exe'" /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkF" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 6 /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkF" /sc ONLOGON /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 13 /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkF" /sc ONLOGON /tr "'C:\Users\Default\Desktop\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 14 /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkF" /sc ONLOGON /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 12 /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\WmiPrvSE.exe'" /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\TAPI\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Windows\TAPI\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 8 /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkF" /sc ONLOGON /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 13 /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 11 /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkF" /sc ONLOGON /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 7 /tr "'C:\Recovery\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\wininit.exe'" /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\wininit.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\wininit.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe'" /f
Source: unknown Process created: C:\Recovery\qJBfikDNRbrkF.exe C:\Recovery\qJBfikDNRbrkF.exe
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkF" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: unknown Process created: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe "C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe"
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe'" /rl HIGHEST /f
Source: unknown Process created: C:\Recovery\wininit.exe C:\Recovery\wininit.exe
Source: unknown Process created: C:\Recovery\wininit.exe C:\Recovery\wininit.exe
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\Idle.exe'" /f
Source: unknown Process created: C:\Windows\TAPI\WmiPrvSE.exe C:\Windows\TAPI\WmiPrvSE.exe
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\Idle.exe'" /rl HIGHEST /f
Source: unknown Process created: C:\Windows\TAPI\WmiPrvSE.exe C:\Windows\TAPI\WmiPrvSE.exe
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\Idle.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: version.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: version.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Recovery\wininit.exe Section loaded: mscoree.dll
Source: C:\Recovery\wininit.exe Section loaded: kernel.appcore.dll
Source: C:\Recovery\wininit.exe Section loaded: version.dll
Source: C:\Recovery\wininit.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\wininit.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\wininit.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\wininit.exe Section loaded: uxtheme.dll
Source: C:\Recovery\wininit.exe Section loaded: windows.storage.dll
Source: C:\Recovery\wininit.exe Section loaded: wldp.dll
Source: C:\Recovery\wininit.exe Section loaded: profapi.dll
Source: C:\Recovery\wininit.exe Section loaded: cryptsp.dll
Source: C:\Recovery\wininit.exe Section loaded: rsaenh.dll
Source: C:\Recovery\wininit.exe Section loaded: cryptbase.dll
Source: C:\Recovery\wininit.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: mscoree.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: apphelp.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: uxtheme.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: windows.storage.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: wldp.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: profapi.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: cryptsp.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: rsaenh.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: cryptbase.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: mscoree.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: uxtheme.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: windows.storage.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: wldp.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: profapi.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: cryptsp.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: rsaenh.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: cryptbase.dll
Source: C:\Windows\TAPI\WmiPrvSE.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Windows Mail\qJBfikDNRbrkF.exe Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Windows Mail\6ed216578b75a5 Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Internet Explorer\6ed216578b75a5 Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Common Files\qJBfikDNRbrkF.exe Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Directory created: C:\Program Files\Common Files\6ed216578b75a5 Jump to behavior
Source: DVuCnBrdbI.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: DVuCnBrdbI.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: DVuCnBrdbI.exe Static file information: File size 1063936 > 1048576
Source: DVuCnBrdbI.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x100200
Source: DVuCnBrdbI.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: DVuCnBrdbI.exe, B3PiA5SFPK5Zw4KAPEo.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: DVuCnBrdbI.exe, YDCBNdBCBGBEhtCfgSo.cs .Net Code: bvb8Ula62E System.AppDomain.Load(byte[])
Source: DVuCnBrdbI.exe, YDCBNdBCBGBEhtCfgSo.cs .Net Code: bvb8Ula62E System.Reflection.Assembly.Load(byte[])
Source: DVuCnBrdbI.exe, YDCBNdBCBGBEhtCfgSo.cs .Net Code: bvb8Ula62E
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Code function: 0_2_00007FFD9BAB00BD pushad ; iretd 0_2_00007FFD9BAB00C1
Source: C:\Recovery\qJBfikDNRbrkF.exe Code function: 29_2_00007FFD9BABC7F7 push ebp; retf 29_2_00007FFD9BABC816
Source: C:\Recovery\qJBfikDNRbrkF.exe Code function: 29_2_00007FFD9BABC7D7 push ebx; retf 29_2_00007FFD9BABC7E6
Source: C:\Recovery\qJBfikDNRbrkF.exe Code function: 29_2_00007FFD9BAB8CCA push ebx; retf 29_2_00007FFD9BAB8CCB
Source: C:\Recovery\qJBfikDNRbrkF.exe Code function: 29_2_00007FFD9BAB00BD pushad ; iretd 29_2_00007FFD9BAB00C1
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Code function: 31_2_00007FFD9BAD00BD pushad ; iretd 31_2_00007FFD9BAD00C1
Source: C:\Recovery\wininit.exe Code function: 33_2_00007FFD9BAC00BD pushad ; iretd 33_2_00007FFD9BAC00C1
Source: C:\Recovery\wininit.exe Code function: 34_2_00007FFD9BA900BD pushad ; iretd 34_2_00007FFD9BA900C1
Source: C:\Windows\TAPI\WmiPrvSE.exe Code function: 36_2_00007FFD9BAC00BD pushad ; iretd 36_2_00007FFD9BAC00C1
Source: C:\Windows\TAPI\WmiPrvSE.exe Code function: 38_2_00007FFD9BAC00BD pushad ; iretd 38_2_00007FFD9BAC00C1
Source: DVuCnBrdbI.exe, RIptap8U06SPwBwNiUH.cs High entropy of concatenated method names: 'EcymbsH0ls', 'Qttm9nC5bd', 'OtFmqrlnpn', 'ALUmo8Hq94', 'UKOJAjlWVaYO9EgANM5', 'xCHXK3lh7AJqTyC1X01', 'vqKYEAlrUOSqMgGJugG', 'WNJTfhlPbDHfMoyfDFh', 'SgFswbljhIj4N4HZVJ6', 'nvbngllGY12uPOn9uTw'
Source: DVuCnBrdbI.exe, PiJ5AZwybNDDwdXiLT9.cs High entropy of concatenated method names: 'odTp1BxMy5', 'MKdp3HOEPe', 'e6ipyIUYc1', 'XiPpt3a6HE', 'BCtprAO4yC', 'BK2Nx7opwWkYb27w70F', 'ym4PeBoqbNgx5iwmRvh', 'PAoqoVokoLArI7sHVjd', 'fvyseaozDfRgfdeMgot', 'keI4NT3vrhldegFqvrp'
Source: DVuCnBrdbI.exe, DGw84fJ93U16kRNDZa.cs High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'M1LnQ7R84t7cs3nc29s', 'VDMmuNRg29P9bexd6wp', 'nnlCODR0Cr30IlByb3i', 'jnOEvCROBJwIpWqeBTd', 'eCxeoDR9kDlSMXEGtuy', 'xeddr9R16BKZgkxneEP'
Source: DVuCnBrdbI.exe, yyd2HDVCSYIOeJ1qXMB.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'kdqsZZssPXED1eDnRmM', 'LWeFsrsa4LL5Rtc3GjI', 'SeZu8Dsmj4plcfYY2Sx', 'bi6ZQ9sidoweAfEHrBJ', 'wQo5GcsEBvDrknS77Oa', 'y67lFosZcSbRFiRU8an'
Source: DVuCnBrdbI.exe, Lv9D5r8jNHiLwMkW2am.cs High entropy of concatenated method names: 'MUSCOjqdDM', 'rLBCE4CBmF', 'oJZCHTHXkP', 'vLscIdHCHWOGYftbq3w', 'l1GefAH3h9SwUuZZkUs', 'rv7uEyHtHs2tfm8rgHf', 'O2RWqnH8NRH03PTFBYj', 'lPsCwlKM6i', 'vpgCSDSWom', 'DEaCmMfosV'
Source: DVuCnBrdbI.exe, TsJXVGB1pi8XV69VHsV.cs High entropy of concatenated method names: 'rHb4FutkGm', 'UPB4Uvn0V0', 'qWLx9BIMfYU1stKQmkL', 'DjM1KPI54ZVPl8oKMbC', 'SyRtdJIygFuKmMGSUhC', 'YsfYifI7O1dTdEBadxG', 'IoyMa6IevjRKIZqfrv8', 'dc5hlxIA2sA4A67BCgJ', 'zhVc09I41aiZfvT4QN3', 'oXmoerIBSbPmJG37ZmT'
Source: DVuCnBrdbI.exe, RMjLB443CBmFEJZTHXk.cs High entropy of concatenated method names: 'SKmQIlAyv1', 'jIKQn9hvRp', 'C95QMKvehv', 'j5uQZdiLSI', 'v60Qhplu9r', 'bW9S3TehnGViAabEuu5', 'cCXfDuerU5N1JfCdqJl', 'hnGL8OejUrvvjLs2vlp', 'caRQb5eW3GeY27HXDYH', 'PQhqh7eG7wsIaLv5aig'
Source: DVuCnBrdbI.exe, oX9EytVQtZh52H4sZXh.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'RPyce7sAvAtcZxJU4Aa', 'zW9n0Ls4Q6gLivsIDMH', 'r3oevbsB0lDnKhqkaVd', 'd9gb7ysDpve7nZEQHH7', 'UFntiKsKvxRlJuBfA2f', 'WXsxOssPxCJVfKfJd88'
Source: DVuCnBrdbI.exe, givdP48zX9266M1M3yn.cs High entropy of concatenated method names: 'WxpsYEw7me', 'n83s5Ofc7q', 'pINsWNftv3', 'qyAO3ZM3jqMkSISRZ2k', 'kVHpKvMtgW2745X3oVu', 'ApKgDPMS9lA5WAphWZ9', 'TEyGnlMoVffHpEHTnpQ', 'Y8NGu5MCKpRMit1XeMd', 'aupPBVM8lJAh821morD', 'oTUeJuMgGMLUxgoCSh3'
Source: DVuCnBrdbI.exe, rlmZAJ84kmg5MhqKxAO.cs High entropy of concatenated method names: 'nEHSlda3bk', 'T77SbG1jDH', 'tqLS96MnCX', 'sYMSqM91rw', 'kDeSo3h1Lb', 'giySaKkEJx', 'Q3KRQ7TBQLOJNfU3b0G', 'Pkm4u3TAuFxDJHcv4ul', 'lkYcv5T4joHb52dsjcC', 'Lr9hHOTDg5XwEs8MfkN'
Source: DVuCnBrdbI.exe, fS9lV0NALvr0R00Zpp.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'IfYTux8xs', 'SLxoWebTybBTMVCM5Rv', 'jGHDY1bcvyG7wmG2vFE', 'qmGpLlblOopdxkbtrUW', 'XaxLOYbHGIyIXYJNGFG', 'QToU9HbyKIDi4tOnLCR'
Source: DVuCnBrdbI.exe, YFeStGVDPL3qTJhpYK3.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'OfFcUEElfXA7470jVpX', 'RTrBisEH56HqVZxMOtX', 'QgnZJ8EyFluQefwrB93', 'W7hhN2E7J1lFFapqXys', 'LiA2qLEMX9cBHBKt71i', 'sgTpeRE5GQwFarJWhkW'
Source: DVuCnBrdbI.exe, iR6DIcvK6Br1GVeoF18.cs High entropy of concatenated method names: 'PVWP42J0uQ', 'goGPvuge3n', 'FmOPwAvVWc', 'YQqPSSspZy', 'imBPmdk3QM', 'Op1PCcU8P6', 'gE2PsUWk1p', 'wx5Pf5Ffh6', 'uPXPeUPta1', 'pNVPQCgMrJ'
Source: DVuCnBrdbI.exe, LSV1q98sQGeJU21BfXC.cs High entropy of concatenated method names: 'FmwmImEhS4', 'e4CmnFyHJo', 'VSYmM9CDTv', 'o1QrjNl6a1Qm9Ad6vWh', 'nybKsZlxxRElgYbjiOp', 'F2q3fYlUaWXacUxXRce', 'xdMZnGlIEfGXfpNoB6G', 'JqHmOtJtqr', 'otemEVyaGt', 'U6imHYlX3f'
Source: DVuCnBrdbI.exe, cvjduLzXfg3obMTxRn.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'DWY8UvnJEOvPnXr6oWk', 'B7TO7anVs7oiWBhHkCs', 'S30OvPnRI2xSMi7UFDu', 'lBjDcinn3sTgg5X0cof', 'asGEtKnsdAKAkNEZ6hw', 'G14TGGnawo8b8VXT05b'
Source: DVuCnBrdbI.exe, QtO5xPVXrrnxoHlMU9E.cs High entropy of concatenated method names: 'lprBVJQUum', 'VPqBByTOcT', 'PAjB8WpmNV', 'rw33n4iLgNUI5fMKCxE', 'ethcFgiFyi8OMaqhGaA', 'O8jYoNi9rTc7cDqqFnt', 'TuMWdqi1BIxhmFUy3BY', 'NTPq6xi2cb60c1TKeRs', 'GCWSk2ifj1HvBtfykYb', 'TFXn2wiwUhrtXwMhGYT'
Source: DVuCnBrdbI.exe, vyQecCAsSDJC5cC4ag.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'wfRVYRRIXrdZbBRXgeI', 'Apl7yNRdBYJO9wmi9Mh', 'VEi9whRY479nJSEwOKP', 'dPnZp1RQhpTFTTOqd9Z', 'lqFwbvRNjLTSNPBdGxt', 'I2IajsRT34lccZhJU4U'
Source: DVuCnBrdbI.exe, yEw7me4LO83Ofc7qHIN.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: DVuCnBrdbI.exe, ALU8Hq4C942vGx2Bcp4.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: DVuCnBrdbI.exe, hgUJYtlCsnx0meOsyo.cs High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'dFwYNLVE6BBg6OBu96P', 'ScJB8FVZ6goqS6TGf5j', 'GU0ebLVxZ2MsrlaQtHf', 'ehFBZWVU7Zl1CeGK6fv', 'I4OmfqV6oSoCeilmDyq', 'QZDwfrVIXmjw8aQjfTZ'
Source: DVuCnBrdbI.exe, rHxUoRw7o4aviqc5OaG.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: DVuCnBrdbI.exe, LQ4siXVrB9PucdpOnLG.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'cvWt3sahuB2gH8DSOK9', 'JySWqoarGrwUdiOdPAl', 'tAqO5xaGxC7ksCc6UsV', 'GfT7CpaX7UDXbgKk3fa', 'mBS96saSM2fqsimKTet', 'ClWDdlaodqeagnUFe4b'
Source: DVuCnBrdbI.exe, NkQLRMtKijBjITN1cD.cs High entropy of concatenated method names: 'coCkEvsOZ', 'TphP16iVQ', 'xTMprxNYv', 'Xay7nKLfZ', 'N7pYLJmwY', 'cHQ5G0uVe', 'uurWxBxC4', 'HiDdQhuakc5TBGwU5HO', 'GXFUZwum7c3e17bAC2B', 'bHdhBpui9hDCJKQT6FH'
Source: DVuCnBrdbI.exe, MordIxv7o9STdbW4EpU.cs High entropy of concatenated method names: 'o2WkiH3K8a', 'vTfkTIYrpT', 'Mc5kXxXIsZ', 'vuIklpo4Yf', 'tt9kbegNPw', 'jQIr04G4YsGTwSLVtOf', 'GcvAEHGewUbA5RlY3QC', 'V80RIgGAkE49HBTAtHb', 'dKnlAaGBngqWquhhiTD', 'YqrfujGDOfC9Fmfgohq'
Source: DVuCnBrdbI.exe, hc3iAEw58Cj1gLtoEe5.cs High entropy of concatenated method names: 'bM87CiUYZi', 'GbV7sFs0ic', 'Dnx7filbU8', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'Tpn7ei722W'
Source: DVuCnBrdbI.exe, ku0MBMV0giKJuSYtAMH.cs High entropy of concatenated method names: 'SrBVqsbVpr', 'puxC8LibaRTunG5HDTZ', 'RDIXEniJWO5k2rYXMZ4', 'Mr8cUAiviF0f9IFxCbA', 'Cr64RtiuvrLAWWBKHht', 'X3NDWIiVFVqH4AdhWUi', 'rV7pIRiR1H1SksdXwvW', 'oy9XtminWMAjE5e3k26', 'TCsVaSDJC5', 'dqCPBkimlsCUWeLYACS'
Source: DVuCnBrdbI.exe, tndxQ74fIiv7SPqqLkE.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: DVuCnBrdbI.exe, jEXlMPv8UHtCOIqOJCJ.cs High entropy of concatenated method names: 'GJytyrjyHeADGLkIwlY', 'wVv5Adj7lxJ4BKyLsF7', 'dTrolDjlwxqj2IkwNuH', 'F0deKMjH9g0jUoNKpRP', 'aEZ1kneNJB', 'J7slrRjeN3mcsVREemb', 'pNUB41jA8YbPRwXqkcx', 'aIx3sGjMTRrUJ2AOXfw', 'FvIEQQj5yDB4Bjj1AJO', 'IfWTigj4mhcIISgYg6D'
Source: DVuCnBrdbI.exe, qPld2gVvHQZC3t2t83Y.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'RawbVKngOLB7mbC8qb8', 'xXTePrn0SmreFBm7yTV', 'ti31IAnO3yBdgCyXeZ4', 'NBt2RBn9IgvII8Lh1yW', 'HAvcaln1Nv0FI8UKljd', 'UPyi29nLKX3eqi071hd'
Source: DVuCnBrdbI.exe, H0QrRZVjPVk0W0fdZuH.cs High entropy of concatenated method names: 'AtCVWsnx0m', 'P0gyA5aQYpELnkRaZlT', 'nE7BxHaN7bJZGrDSDZH', 'UAhOkvadkbtRyrRkSfk', 'EgDPH7aYKgGbtav6ZIq', 'An1WDLaT8MlV4vjejgi', 'GmItuEacEurUA27b3TB', 'BGeTj5alxolYWjfnLhN', 'JKvoaUaHnDUuT4KgItG', 'f28'
Source: DVuCnBrdbI.exe, yiR6J68lAuKTplAkGy7.cs High entropy of concatenated method names: 'sg9', 'GegX24Sd1c', 'daiCLwfgAE', 'SOdXJ7i4uP', 'acSy9MyOSu04mTYMNdU', 'tpYqlWy9gmXnolQuO23', 'RZs40Ky1jhIDOJFC76U', 'T9ngpxygSsNTWFFDr0d', 'M6sMWOy0jVamxNKZ11H', 'TVREuXyLT1BEI3D1RRY'
Source: DVuCnBrdbI.exe, SGtS6GBngGbWqofnHDI.cs High entropy of concatenated method names: 'CAGvWtS6Gg', 'DdZUXEYqrheDTvyTAij', 'lQE0sdYkViHPgff6dWs', 'eH9eDZYwEjw5WCdqTjd', 'OLMNwWYp5dk5ySyDihy', 't44Bo1YzIaABJQ6c1fE', 'q25AS7QvRZTLkWApsqq', 'IeatifQu6ZmaqqWnyMH', 'pmlBtgQbVLmdyvmqCPE', 'ctcuvNQJ4YE5GLaBOUv'
Source: DVuCnBrdbI.exe, sHcJnfVEgiZPHfdDGRd.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'I3wKKYsFFaAdeab10LA', 'AFkPjHs2eju6rxqdc5O', 'x6caIXsfYNYVyB3BCn6', 'no70vGswnR2N2snMRHm', 'eCMg4NspJb0UHZatJqH', 'hQQ9G6sqfQ3FZxEDfVu'
Source: DVuCnBrdbI.exe, gVQRl04vLDrtRti3n9Y.cs High entropy of concatenated method names: 'vLTeHy7oiU', 'qEZrxr5NDo4SaDf06P9', 'DSpeLn5TlSZwk3JVXmM', 'hmGQrU5YowvUa9Uf4pU', 'QRo21K5QPipHhY4U3If', 'Ih6s017KVo', 'EcKsNKFI50', 'JkEsgG5cDX', 'NoYsIM2h7b', 'XcLsnwu1GT'
Source: DVuCnBrdbI.exe, qoojHgVofb3ALJ41uLS.cs High entropy of concatenated method names: 'Oc1BfsECpT', 'VpcBeuH6G7', 'nUEBPyEZXUBsOwb9WqX', 'nEJHONEiTXWYbbRYKkm', 'hXXjibEEGKXuaxMRE3j', 'gm5FPLExjBgDsLwRW6T', 'vIBR1LEUfI3jnuxSpP0', 'H7QJCiE6M8cEKUAiCvb', 'mEDsagEILc1vtCYmbfG', 'NgCZfrEdLbnFmuqm8Tu'
Source: DVuCnBrdbI.exe, X05Xnlv0RaSYmk2k2Hq.cs High entropy of concatenated method names: 'XIXkaKxmZO', 'fRVkDfVj7P', 'MwCk6Xmt8g', 'xKjCvjGoxxcgdYTMpqR', 'D9WLqpGXU54cmhODmNZ', 'dSUK6DGSKGNBd6bU0Ba', 'OD7JcfG3qh5IWLtZZUI', 'epmcUJGtxlvDR4h43Za', 'wOSIlPGCXU6ZE6EksE8', 'da9o0lG8si7xYWkThyp'
Source: DVuCnBrdbI.exe, pxKvak4dWUvW3R9TSi1.cs High entropy of concatenated method names: '_7zt', 'oAEQjOtwkp', 'k5YQ1BEpKm', 'ct8Q3bLtnR', 'olUQyfnj3p', 'LYqQtnL24T', 'JTgQrFuZ5h', 'EC9DM0eyCSwEOAGFGjQ', 'Cad9cke7XSjIY4hStFU', 'FMbF2relZjLpX1c2h1u'
Source: DVuCnBrdbI.exe, GVgtPs472aDxRxCkP69.cs High entropy of concatenated method names: 'cgAFINx4ot', 'Q5IFnqulrd', 'ub4FM0TD1c', 'u1tFZcR9tW', 'D4RFhE9Mme', 'FQvnjGATrhs68DgZVke', 'WoXkKrAQN0FfRQny8Oy', 'UPliOUANFS8nHxyspcn', 'gFuWraAc1XRdSriDuiS', 'JD3nGmAlrw3swIv3y3u'
Source: DVuCnBrdbI.exe, F0ZwPa8obhBRGd6MvZt.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'hToX0BtyGs', 'Ok6s4JAuRF', 'UPxX70NTJG', 'Lvnu0b7Ucle48dZ3Vec', 'YugiKR76lRpU8iADX1i', 'cRHftb7IKLwgolc1RhC', 'h3envg7dtpvp5vnqfre', 'uXEi2T7YKJetI8G61sy'
Source: DVuCnBrdbI.exe, xslKM64HitpgDSWomNE.cs High entropy of concatenated method names: 'wamQ4OfUk4', 'O7vQvPo51U', 'ghyQw5myI5', 'fkMrHoeYU6hiFeHTvwl', 'mw2RdGeQkfpQf3EuvP0', 'ftkVX1eIrI3hajPgHf3', 'Na2UGEedBCEiuVFTh8H', 'sKH0QqeNKtaxJhsCQT3', 'dnWy8PeTsuNwxE4pqdY', 'bCqwSXecOKbyV7pwhcM'
Source: DVuCnBrdbI.exe, w7Byry4xl2Gv3GCYMSC.cs High entropy of concatenated method names: 'BLqUL0O9Cx', 'ApZUnC2pYD', 'MNMUMNfWIm', 'OEBUZajgNY', 'RJFUhHQm5P', 'nMtUiyjH4K', 'Yw3UTlf6YR', 'GNiUXE2m4T', 'qvPUlUgULe', 'LaNUbsci1L'
Source: DVuCnBrdbI.exe, BKmBCNwaqyfMR0cEu2Q.cs High entropy of concatenated method names: 'jHR', 'B92', 'gwbWxdCkSM79QEtCLqR', 'B1PPVmCzWPUVASIZoTW', 'I4klJc8vp6DeYXE2pVe', 'uPMowD8usZ7KLyqILfy'
Source: DVuCnBrdbI.exe, YO7ZWZVSHisLDSV9L9d.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'fTop7JnfxLQek279AQb', 'dNj2AYnw6HSC0ens1LI', 'KeZSIhnpPwxMk3DRLD6', 'Ew7pvOnqErA4cpNEnJ4', 'xPpxn4nkAnqwtBgxKgO', 'PdYgkDnz0sgkxwSQbmH'
Source: DVuCnBrdbI.exe, VPw0KGp6XdNFDHOFwY.cs High entropy of concatenated method names: 'hcVnJYb5c', 'F3cMhHUCp', 'hphZsNIwi', 'qfGXgQuXKkpjVBqYNCg', 'PPZZ3furNPNId5PcjqD', 'YBYsjeuGx3vAiP8SZFd', 'ebedDruSM55gA8qeWOA', 'Uts6Oouot0Tj2PBCOZO', 'u0NXqYu3N2U3240rQwO', 'oFsknautWvOVk9ROQCK'
Source: DVuCnBrdbI.exe, ivQgfOvu9WBfdrHvID2.cs High entropy of concatenated method names: 'SgwPYrUg2Z', 'Q1yP5EDlyV', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'KtdPWdUH4s', '_5f9', 'A6Y'
Source: DVuCnBrdbI.exe, JBmFAhVnNJQD3goIYHj.cs High entropy of concatenated method names: 'FoDVxJJvQD', 'ILFXDLiMk06Cnlf6j7D', 'IYFXpLi5m0DfjnZbfjR', 'GSOmqGiygnbCQQdl3Yj', 'HEhXjti7MI5u8qPDhJx', 'skx7HOieF2ZnhZKoLjM', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: DVuCnBrdbI.exe, BkaNGtwNtHcvnsjC0AQ.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'DVR7PkyGZU', 'pxL7pmK0eR', 'rmd7789uuh', 'ctW7YXJbQA', 'dBs75Q1I4N', 'eXO7WbNXfc', 'STOmCftGoRIo3gDQukh'
Source: DVuCnBrdbI.exe, mBPngCVhH19ZSlocmdy.cs High entropy of concatenated method names: 'm16VLkRNDZ', 'YRUJpdiGTux5Xj7rBLI', 'jkVueIiXeYXMHZmJLSX', 'IPCn34ihHKSaIghnwrS', 'a6YVduirmfYJSNWIgOY', 'QAMeMDiSY3uPv7dDQCZ', '_3Xh', 'YZ8', '_123', 'G9C'
Source: DVuCnBrdbI.exe, lgQLEmLFprJQUumKPq.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'HT45sWR2T7RT9HZEBe2', 'fV84FoRfFIhXDbPAxUv', 'bQuWewRwbLZqQIkdEux', 'W5SqTvRplkLhGJ7R2Yx', 't8PZJ8RqwdchAoXEEpA', 'fdg2WlRkxANPx0xN6fa'
Source: DVuCnBrdbI.exe, aSVc2nVynko4Mai6AE5.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'chpglJaMiKfr2U6gryo', 'M6VOWwa5NTGwgRxeAns', 'VWBXl2aexWMZ6ruhSPO', 'BspyZWaAVjdk9oGTIsw', 'si4Y3Ta4Uh6bJ8wgUYp', 'YQ2NFraBlSWGUpsxnce'
Source: DVuCnBrdbI.exe, hSGtHB9U8l7pUja4CK.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'lZ8GV3VQ9aXUnufaOkf', 'o7q7EcVN060RPrve7e3', 'K4oG5EVTHHCAjmwEKF8', 'q6CirMVc18PQgfJJoMv', 'FN22WqVlsawb91FHwsO', 'VayVC1VHUs2UEqMZ3VS'
Source: DVuCnBrdbI.exe, gfBTFgDDcun2u6c0JV.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'BClhCSRnTAiNFQvRH3l', 'JdHAXdRsFO3eP3pssX7', 'XYB9qCRaAvweJXU3qgA', 'SfVlknRmcUhiBtf7FUg', 'Ng56DkRiuSRQxZCPaDd', 'py6HRUREF0nVshX6kTw'
Source: DVuCnBrdbI.exe, XE18VcIBm554oCfhNR.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'FIZbAXSDp', 'aoBPodbh8Sf3olZibvO', 'rxBaITbrAuLnLA4Z5QD', 'p60c6gbGVORp5ccX33s', 'pGl8dVbXmlxngpBgu5V', 'GmwX9obSoGAGkDEsEvJ'
Source: DVuCnBrdbI.exe, QO0x1mVPygoruqtH8yc.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'gULc71a0xCtaJ9dEGqc', 'MFLBCbaOtsBtQWSOpwY', 'wcvVHRa987CvCnaVY5Y', 'CvgpIja13IN6ecppYPL', 'L7qf7jaLBe6rVsaTgiu', 'XUKsumaFBkEL4y2PFgv'
Source: DVuCnBrdbI.exe, A5llBkV7iDdTyDnupOP.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'rTVvKUakQJJDnVbONLj', 'I97X3mazGsuU2djpBYY', 'jxDKipmv1OhSnaIMjvH', 'g7wOfKmuIUumYox6TXc', 'BosXhNmbDq7oVVHUIL8', 'OGgafQmJ1vH4i3PM1xF'
Source: DVuCnBrdbI.exe, YtfqWG8yoa8OD2c3ToD.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'cEdjUryU8mZPtsLASSt', 'X8As9Vy6HyeUNn8BD75', 'dW734myIBI1JCFJwMwf', 'Ux7oHkydmq4BWMIOq4V'
Source: DVuCnBrdbI.exe, y4X2xBv2mc5BoR8DQTs.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'UEePrsH3kh', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: DVuCnBrdbI.exe, XHf1ZIxRb4YIoDJJvQ.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'r1B2HiR4qBnYWmPoYVO', 'EH2YNQRBZ2hslNeRsUB', 'x0far7RDYRkfgqoLuKR', 'E9LVhURKLwsUrbhRyyi', 'KgfJQNRPuDBkhThsCZ2', 'QaqMK8RjM6NbsgRgr2q'
Source: DVuCnBrdbI.exe, AybnK3w9obygkWjGk9F.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'LcEWChBtRg', 'wPDWs5r71Z', 'y3wWfDx1dn', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: DVuCnBrdbI.exe, d5iYKX4JtrggK2b3fOB.cs High entropy of concatenated method names: 'T1cOPDBNTI', 'NItO77aLqo', 'FCnOFtOfbS', 'X6AOU36JuN', 'k7jOOki5na', 'X8cOEZMxTN', 'AjIOHyiYsc', 'H7tOGnaZXQ', 'q7POd0F7sc', 'N5nOjh3A0f'
Source: DVuCnBrdbI.exe, iIOZt9VUUfC8Y3HBLGR.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'TxLXwdsSYkjSG8gXTAB', 'WUJDKbsoqBQn2ZbBRA6', 'TsBaS2s3SpFthLhW0TE', 'uFB4HQst9PfHJw3loAF', 'zDDOGPsC1Xed7fCGFE6', 'c5Q7D0s8GJoVRhZZJtb'
Source: DVuCnBrdbI.exe, eRp095wrKvehvf5udiL.cs High entropy of concatenated method names: 'IGD', 'CV5', 'xVxpkqc0dK', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: DVuCnBrdbI.exe, Ace7My8QAUUI2GccLFD.cs High entropy of concatenated method names: '_223', 'cW7n3elQX2UCQ4QH9rL', 'acGlBLlNiKv2Tfk0l0V', 'sxmvCIlTs4aweBNcnGr', 'VVnLm4lc9i8r88iFFfG', 'gYpeUcllqGwR352IHhO', 'fOQnm9lHdAgbtn9LFnp', 'OKuOellykUoUo2b1D7u', 'qkZyU9l7mtiPn6TGk3D', 'YxCsmFlMvKYCA3e1VnC'
Source: DVuCnBrdbI.exe, moFQNWvn5UIetFHchWk.cs High entropy of concatenated method names: 'YpjPRObhyE', 'l324EfGp6JepmBAGx3c', 'T530aIGfgd6Kpsbb2J3', 'xO05JCGw25svUEF9QPi', 'byGLZnGqcvH6yvHW8ya', 'coBgGrGkgsAr4j5VN6r', 'IJ9XUHGzRgrpkL6RYQT'
Source: DVuCnBrdbI.exe, LuKqOT8xM1iqHtJtqrE.cs High entropy of concatenated method names: '_269', '_5E7', 'y2cXk1R2RP', 'Mz8', 'csZXNHBHDP', 'NMo8Q67LBUpTRuEw5Mq', 'KgI6aO7Ftl3DK772PpN', 'Yqqh2l72flc8YtPKyFG', 'KlG9Uw7fuI2ZQZcJSxf', 'ggDisY7wqyFIDqxcmkc'
Source: DVuCnBrdbI.exe, R8bZRPVJKwFaypbPDbH.cs High entropy of concatenated method names: 'NcvBjXuO7Z', 'FNIehEZng5PO9eSoxQg', 'QAavXLZsd2FhTNKcC0r', 'YcmAn6ZVEH5FY6hN2rg', 'fGMWyEZRSPqfNiYqWDH', 'jjkKNKZaVNsAM7M7ARG', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: DVuCnBrdbI.exe, aWXw25wIBEfCACPUfrB.cs High entropy of concatenated method names: 'Dyx6HqCVbWciNfIkDRw', 'ravZqmCR4FVAu7LpKiR', 'UAaWQjCblZ9WauR1cKA', 'AQi1JmCJxIjSaZ44MiA', 'AHx7nTkntV', 'WM4', '_499', 'TV67MgPJJE', 'FR97ZLEJJE', 'aEL7hCiAfu'
Source: DVuCnBrdbI.exe, NU7Fk9wZcq5aJy9xgVf.cs High entropy of concatenated method names: 'UTb5hRgJdJ', 'o7d3yOCD7jWPKorTQeK', 'iSXmgQCKbltqNRKLnDo', 'k0KymwC4mbH4wDdDLIw', 'HOusp9CBEejmIqVl7B6', '_1fi', 'o5PYA3G6pl', '_676', 'IG9', 'mdP'
Source: DVuCnBrdbI.exe, YDCBNdBCBGBEhtCfgSo.cs High entropy of concatenated method names: 'QRt8gnFMvO', 'K778IqdBZd', 'Mat8nO5xPr', 'wnx8MoHlMU', 'NE68ZL63Wt', 'sGS8hV6DtS', 'lLF8i5fSgv', 'KjXGelUMBF99hBhVFpc', 'nHU3ORUyDfJpbqOPmBq', 'snXc5uU7n97u8xYsjYb'
Source: DVuCnBrdbI.exe, Uch4a9Btkm015d75762.cs High entropy of concatenated method names: 'mlW43OI9Zt', 'my64yMKpBm', 'upZ4t7Bsg7', 'FUO4rCXQJC', 'jZw4kjbhsT', 'vP6FredvBDXD7hSMieJ', 'sRkqoGdubYI9cOnpxUD', 'zlwsaXIkdZ4xFfIcHxW', 'gspUEhIz9cj5CZFse1L', 'YglAOldbZ7ycQ9UWsCO'
Source: DVuCnBrdbI.exe, YOnnoOBT0pWYipfXwJr.cs High entropy of concatenated method names: 'CB4wmIQHsG', 'dFIwCWN61B', 'Ou5g79QfTchXL4CUMaB', 'obQ6usQwu1ZmwBkwyZj', 'U8Mbe9QFBXD3xO6fpNe', 'RvRSjkQ26qZDVWdkU82', 'MH4wHeqhOi', 'SdYV2nNvynA6kfrAHLU', 'TLRtZLNuAvEZvSTP56g', 'oYt0aEQkYdVqsCG73am'
Source: DVuCnBrdbI.exe, xlMCeKVGHCd3cj8LArO.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'fmNtimav9pYaXsOWh0D', 'AUEAYYau3pVTdeGqZsu', 'g58OtNabjV3YaVeIyli', 'HSq6CIaJlpgeYREdvkr', 'oSg1V8aVYrRKjIqdYeO', 'a7NDnUaRjfXSZ7VyJlN'
Source: DVuCnBrdbI.exe, XCudnwV5CdAXMdDg2Yp.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'GXOr3TmrpkyagUirK8v', 'l7dqmNmGBVYrwCwyQXv', 'uWeRiSmX1tqNCAxaw27', 'SqliGTmS7ZayQX4k0pq', 'wyhHxvmoKVJkaw51c2B', 'LtaUMim3h6PIjQ3Sk1s'
Source: DVuCnBrdbI.exe, Dvak0T8Jon5xyKol11T.cs High entropy of concatenated method names: 'N2hOfPMGM4bjVMABE5C', 'Qt9WXLMXdM48C5AR4Wy', 'BWPbt7MhVtPqkkHEoyd', 'cL4irMMrJ9160Gry6ur', 'IWF', 'j72', 'EpusHQR0c3', 'S7ssG3M3Qu', 'j4z', 'RwIsdplgl2'
Source: DVuCnBrdbI.exe, AYUEweT4hC6RErnDpY.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'U4GbxBJwMupiGkl3Jv7', 'ObvQlKJp1QwHFfxTIGK', 'VPCYDyJqEFhu8L8v6Ns', 'vJ7LXsJkCrpp6Jo5G0w', 'fVAULVJzXOQq1VnBPXT', 'v0tMFkVv8tsVh16hGob'
Source: DVuCnBrdbI.exe, Q3gY0ehxGaSsvRk9b8.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'h87MLiJr2VuGDPKXgO8', 'ICHOg5JGBAwWm6hmc4N', 'C2gIgcJXBh3vkJcelLW', 'yjqegnJSYkDROGV7OaW', 'lKoR22JoMXhecUImvU2', 'R73Z5pJ3Lw7s5g5SbwP'
Source: DVuCnBrdbI.exe, BXYVq8V8OZ0E49RC78R.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'JaTiumnDCSKnmSXPES6', 'nmbgrpnKGoNMSJlUNEh', 'Kv1i2JnPSpAnTMDn389', 'j5E83NnjcsPM1ZmdOhe', 'zvwsa1nWlOd30QGn8y5', 'NwiH7knhVRrKOcxVEsN'
Source: DVuCnBrdbI.exe, LPc6tMvCS3kp5hQ8dXL.cs High entropy of concatenated method names: 'SUlk1vTrr4', 'Ixsk30WaA3', 'z7mg0vr2WM3QeAyFWKL', 'DIW8pGrfJR8qB6xRuW6', 'ufIXjlrwKLhN3h9ijrd', 'ml1JmDrpCZ3SdtynCpj', 'KBK7jWrqPPtLjdOU9U4', 'EZJo59rkOBoJAhGiqDN', 'it89FHrzFZeMurS7xZr', 'B1BjhJGvArTnZIe7LrT'
Source: DVuCnBrdbI.exe, zKthyiSfTkptl7SJs7d.cs High entropy of concatenated method names: 'PvpYPdFFYsYw2', 'Crc9i3gIaSSswWONZeW', 'YCsLklgd658B7qhQ4Tb', 'LKfl4ZgY7fYuKrjhHJU', 'XflHJNgQOnhbwcWh6P2', 'taNTb4gNEv2wWoKbUTT', 'bhuxQFgUy0eNuUhWF5i', 'ctVhv6g6TC4OoqTnJMq', 'NHd1KYgTkJm2PBhNwXB', 'j8WKQWgc5snmvaSd1sO'
Source: DVuCnBrdbI.exe, IQjosh8GjRSZcWFuvk5.cs High entropy of concatenated method names: 'Fivmc7SPqq', 'YkEmxaXb3R', 'mFsmK7bSKK', 'h3XmJ9HxDi', 'Onsm2eWdOa', 'Xr3cXbHn76yymmWvAqx', 'yqJd3iHsdEffVFZlZWF', 'VigZHsHVjsmE9meumPT', 'RFWYdbHRW40fiViKLVq', 'Ri9i3VHaTQvoTvyoROV'
Source: DVuCnBrdbI.exe, WF99MA466yNsjBSgpuQ.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'gJsUO7d9ao', 'cOZUE6JOhS', 'r8j', 'LS1', '_55S'
Source: DVuCnBrdbI.exe, syVu7owweJKHQlr4gkP.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: DVuCnBrdbI.exe, uC4PdPBHNJh03HyKHgO.cs High entropy of concatenated method names: 'tAM8L8hJS6', 'xAV8uSuDCV', 'vaM12q6T5mVA6ZFKweW', 'SxTkpY6cZ0hcRtAoNmQ', 'yOYMoW6lZtQ519AsVU3', 'Y2IlhP6HJvYPQe3jlhV', 'F9qRsN6y4ytF9tu1XIa', 'QvmVaA676fAtL1nPYjc', 'KyGAP96M08TSPBesRkM', 'JtpYTy65LSLIEkrMWKB'
Source: DVuCnBrdbI.exe, nuXIZB8kx1c0t9bruaD.cs High entropy of concatenated method names: 'fn8CgvBiAO', 'Rp2CIhrLJq', 'sc7EMayNkqG7nmrYCYR', 'fF12IRyTW4R7h5uuL9t', 'OQWHTcyYP09nImwcBZf', 'bEn4JSyQZJJuFHCSsCI', 'xGpbduycGmvXNbFyrMs', 'CThp5oylSYZwQfrC3nN'
Source: DVuCnBrdbI.exe, KmsbOA4kD2lnvCOV3iq.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'aWXFRw25BE', '_3il', 'jCAFVCPUfr', 'b2LFBNewX0', '_78N', 'z3K'
Source: DVuCnBrdbI.exe, pxDiqn4QseWdOa1yu8l.cs High entropy of concatenated method names: 'RSGeM32XWV', 'MifeZTqLbZ', 'xsvehQgfO9', 'CBfeidrHvI', 'Q2XeTyIPhm', 'Dx9WhE5kJsVAIyREdm8', 'CrKemj5z8dl3BDvXvSw', 'EdnlXL5pXEw77mXufYx', 'b8Zywb5qijS1Okk35yg', 'DxKFIVevjBvC2jjyhAM'
Source: DVuCnBrdbI.exe, Q9LpeJo2QG4IU5K7SQ.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'kPxgooVCApfeD1ovmUb', 'XWNoQuV8TZYZ25YGCrP', 'bArkBuVgfRhr9GuKoI4', 'aOrdraV0HvqUrwpMC9V', 'TtkQPaVOuixZmoUTNB4', 'Hv0H2dV9ScHUMdnnC8S'
Source: DVuCnBrdbI.exe, eHNF7JB5hRA82TIHbTV.cs High entropy of concatenated method names: 'lh54LvUuD0', 'fua4uH09fP', 'Ycs4zJXVGp', 'J8XvRV69VH', 'iVJvV7tcRx', 'h7KvBEum9A', 'C9xv84jFth', 'OrDv42gkLy', 'wsWvvjxch4', 'RGFNpYdfJUjYKUexnO9'
Source: DVuCnBrdbI.exe, YtkGmxBRPBvn0V08G7R.cs High entropy of concatenated method names: 'QbiBPjdDxV', 'uuLBpeCn31', 'Tr4B7Macf3', 'uLtMXWZj7MDgorn4eVR', 'TU5ouNZWZi83aRQ8aio', 'WYn64gZhXfFsHNT91Vk', 'elTP19Zr2rce15SOrbC', 'owl8heZGLvR2WNRkcdG', 'PfNVrpZXZDWCyfSnWnA', 'LPObXhZKIZ7RVpTLHgS'
Source: DVuCnBrdbI.exe, ClH4eqBuhOiwBRlawos.cs High entropy of concatenated method names: 'yIZSPc8xH5', 'PHXQkPN19RlwwTv8kkb', 'TKQvq0NOLxdA9BnS0tn', 'jr882xN9LIbWD25VX9v', 'PnyFtBNLIfSmagT5SpP', 'RspgUfNFaxIFPZsooDP', 'fSbSdjKIVS', 'FKjSjq7FBL', 'obQS1s9JwU', 'QoNS3x9PNE'
Source: DVuCnBrdbI.exe, Tr4MacVff3TSVPP3wLK.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'RruDjpsTGpb8nOaayH1', 'LHALnFscDNpd1PulnEn', 'TTyZlcslOe4DV0mhThB', 'eaQI1IsHu7X25QFyod1', 'WcFadksyvg3N4x3tCly', 'cibqims7SFQH3DG1Z51'
Source: DVuCnBrdbI.exe, JKwKEnYLHcTrtV2mxA.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'CVKHVFbEocTrYs6TKVq', 'QJLGhxbZr38rR87hHB8', 'onOGxqbxuwSXfTWlC68', 'G2wn3YbULvFwRc3sDwd', 'oHOaDQb6x66jQXFBdI2', 'YPPN5abIrBJ90KqA6fr'
Source: DVuCnBrdbI.exe, KP73KMSPcc0Kh1HxNhX.cs High entropy of concatenated method names: 'ymSNkEw1Om', 'xXJNPbLFeD', 'oPfNp24JKQ', 'CRNN71pbO2', 'JvGNYueoVb', 'yGpN53j0p3', 'z7DNWXoBAm', 'xVfN0kCBTQ', 'UNSNN7ArfX', 'OmaNgOI8aA'
Source: DVuCnBrdbI.exe, e1h076Bd96rshehvd6Z.cs High entropy of concatenated method names: 'dpl8zKpV5r', 'YYD4RGrSoK', 'VF14VeqMd0', 'HVK4B1Qed6', 'dpS48Rdm68', 'MZR44PKwFa', 'upb4vPDbHP', 'HwA4wf3Egy', 'c3m4S3CkNB', 'Qhy4mq8mWj'
Source: DVuCnBrdbI.exe, jKlBYXvgHY7L5EWBbd5.cs High entropy of concatenated method names: 'dFakcVHPPN', 'stkkxrlaQK', 'MeTkKVDRHF', 'V63kJlX56J', 'zFUk2NC2CM', 'DFlkLH1VoI', 'oUufSIGO0lVXDVaq4kV', 'rSiRwEGg7OIOJGDup33', 'OYPoCtG0jtiehVYjWFk', 'aDvKaDG9T7tFn1wbAf7'
Source: DVuCnBrdbI.exe, kPIDtbVuosvAXS9GxpK.cs High entropy of concatenated method names: 'CjYBt10rpy', 'r2HBrDSYIO', 'kJ1BkqXMBD', 'Nu9O9ZZEddYvID40Ybg', 'bqtgovZmsGRciRhyn9A', 'fBTdtaZiMGarEx1gQr4', 'jSHAVkZZTqE5pAbdEhP', 'm0qpWHZxhjTo2Gs1X4J', 'cV37rUZUtXVXGuXWO6q', 'lMqLoNZ6WeVPjFK2mbW'
Source: DVuCnBrdbI.exe, WjwVLVwPWy8E0J76RDX.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: DVuCnBrdbI.exe, nlibF7Bha9YwnkuUxJP.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'tegvnLg554', 'rrrvM6Olib', 'm7avZ9Ywnk', 'YUxvhJPuwG', 'fTIviFKoE4', 'KjEBBGQmKu0JCin7dDa', 'JFTS4vQifJ5VjdAXoM9', 'FV4P19QsSwHR6SrwHgd'
Source: DVuCnBrdbI.exe, kx9L55Melm6QQwomkp.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'OuNlRLbq4Ihx2qaj3aq', 'Qf2ZrObk7gkuWMSNMYD', 'SfRjpObzO01CHX2jKB1', 'IobrKSJvFlQqd9U4N0d', 'ALlWHsJu2xD1FGFGH92', 'KSfNUnJbRhBKvckeTTZ'
Source: DVuCnBrdbI.exe, pBRLJWVAs7w0PoMx3AM.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'lSGb0QEPU8noiFLrxJo', 'F5FyvVEjV24Uk7sEvM5', 'UwbtELEWQCNuBpZU0FV', 'Ap53ksEhcZ88FOslRlf', 'GQnrTTErdXDIgE9yQ7X', 'rHMnSHEGqFETt6DmeoT'
Source: DVuCnBrdbI.exe, B3PiA5SFPK5Zw4KAPEo.cs High entropy of concatenated method names: 'w6Dq2IgeavecmOQCemB', 'PS7SIHgAZsVYivxyHrv', 'TI0DbQgM9r3oUAcrPE6', 'ihGnUqg5nPAUH3nHjR3', 'h7oNUvV0uk', 'PifjgpgDQsYEu3OvgC9', 'Ve4Af0gKvmhMTVFiPqZ', 'b0ygtygP6bHPQheD6VK', 'zVXUExgjL4pHNSO3tYt', 'JLEBBhgW68iVF9SKSRv'
Source: DVuCnBrdbI.exe, KXjbPlwRN4DQenO4GDH.cs High entropy of concatenated method names: 'awvPqFdncj', 'P8EPoMGj9J', 'A4NPaY9kT7', 'Pw3PD9ViZQ', 'm62P65ADvb', 'ckCPAE91vT', '_838', 'vVb', 'g24', '_9oL'
Source: DVuCnBrdbI.exe, vDVjqVSwxVPV4PrQdj.cs High entropy of concatenated method names: 'ajqFVwxVP', 'uNRbLSjZh7ldYmik76', 'hNdDu5KcnYZb7v13PH', 'T2iUUKPbo6BdH8jtl8', 'mFY7mmWJsE0ESWpNvW', 'lPimxrhEv1hSpca6UW', 'O6jBM52fY', 'Ftw8beuVX', 'Xh34yDqg3', 'p1NvF2YtP'
Source: DVuCnBrdbI.exe, AkQ0f2VVwG2Mb7ZZLSw.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'YpVB1RnTROB28BWNUyA', 'i0RPXWncDEotQkDGxDy', 'Pthb3pnlaLyXgrwA7Fu', 'neDCW9nHfgiBOScMPwt', 'Hgn2hwny2RgWCAZEcE8', 'KYvyKKn7TtWISCykTpt'
Source: DVuCnBrdbI.exe, nLdkIevc5rQ5Yojxgvf.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: DVuCnBrdbI.exe, mJ48Al8DSB49fNR3GdB.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'KuAXjYyw48', '_168', 'Rh00SI75KQWX7u2l4TJ', 'z29grc7evowulhBaEMC', 'ciTNCZ7AqSBpi947BpQ', 'jNJUNe74iNJ7rNaSLBN', 'xiDpcw7BQg6SHypLXXQ'
Source: DVuCnBrdbI.exe, aWQMws8AKTDeyeKVHTK.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'TGpsfYb4po', 'TkCXipivWX', 'lk8seoAl5l', 'PdCX6t3WGN', 'Tb1PYX7XIsrKv1bPR23', 'mdKEib7S8gisHxW2Qjy', 'xCjxoK7reQsd7jqPXDF'
Source: DVuCnBrdbI.exe, EJFUu0w6m79CLJX5DOy.cs High entropy of concatenated method names: 'AY0WtwZPUl', '_1kO', '_9v4', '_294', 'g0YWrsjHpQ', 'euj', 'yrsWkLWANB', 'UcxWPSqYPi', 'o87', 'pGHWpaTSXO'
Source: DVuCnBrdbI.exe, Gy70XvBUvHsHbjTtgrF.cs High entropy of concatenated method names: 'qqH8JBRLJW', 'ypv3GB6JARsaNTpSNYC', 'dTfCtw6VhtFTiGg1xHs', 'oSRFEw6u7YjlhFdWffh', 'AhFuud6bZ3fmLQj1kTn', 'bQU5Nh6RTlKF2IgXDVX', 'AIevcF6n3jE3y4aOF5D', 'OcMFBc6sARpGdLnOJvq', 'NUO72c6agb2itVfhcJn', 'hJZbuC6mqlbvyIW5S1E'
Source: DVuCnBrdbI.exe, x9P2cy8E4RtymtUqNoo.cs High entropy of concatenated method names: 'dOXmDvIwyH', 'eClm6VcGoe', 'T43mAndxQ7', 'LJ5qU4lgyWDUm9O6cxV', 'j5Qvj0l0v1AfcnCecTl', 'EoVh8YlOwFPHHtbOHIm', 'SoTF2rl9aYBgp12iSuk', 'dnmJ1ml1Q7HV3lJswah', 'pyHsqRlLvbwrj47X952', 'PqNsSRlF4N5PfriGjSN'
Source: DVuCnBrdbI.exe, zbF9E6wBfrMO0MnM4Z2.cs High entropy of concatenated method names: 'fqFpm1d3nD', 'w1JpCKfolH', '_8r1', 'K2VpsW8MPK', 'jPjpfeIMdc', 'hKTpetr22v', 'ut8pQHFMsZ', 'KZMLHZodka40UYj14vH', 't00GGxoYEaIq5S5H9Fd', 'aGd96QoQZXcEURvWrWd'
Source: DVuCnBrdbI.exe, q950kq8VfS4H4FbWdCq.cs High entropy of concatenated method names: 'fn3SWqZtEW', 'ulsS0PIBif', 'upcSNMMDXT', 'z06SgtKJtB', 'j7V9ONNzsv3Je4T7NjN', 'TxjflANqRnnDrpyqU7X', 'yPXHRbNkTkidcc9pr2X', 'GgjJa6TvVF2HNBXorQX', 'SBTZkrTu1fq0HU25POq', 'todvNATbJ79nkvNs6ij'
Source: DVuCnBrdbI.exe, pUrZPC89AykTmtxbUMP.cs High entropy of concatenated method names: '_5u9', 'eitXLyD5ta', 'iobsRFS5m7', 'il2Xoh9YKP', 'FPeZjkypFW4e3RknEZR', 'DBtbX1yqKm5CG95SYns', 'eLGTfOykc2e9E4Y2eKo', 'u4hsS3yfvQwKK6bsSYM', 'Y8torjywgy2ZFOa0Xko', 'y6IP1vyzgeV1fSLT3rq'
Source: DVuCnBrdbI.exe, zdo7FbBBcekCrsqxGvs.cs High entropy of concatenated method names: 'cMoBaMgP8j', 'B1ZBD0QrRZ', 'xVkB60W0fd', 'HuHBAAUW5C', 'MAGBckrvJW', 'ir2BxbW520', 'amfWHJxQ2voCgYDkvQi', 'R0j7hJxNUAYOEg296jm', 'JD3b7Jxd7VyR2ibZdpJ', 'McHJZfxYTM9iTIa2Tas'
Source: DVuCnBrdbI.exe, y4ifx24tXPdD84aeaEd.cs High entropy of concatenated method names: 'aiHvjGe8m2O5vhoLrRf', 'FpVOwaeghcD2i4CtZI9', 'QwGl4Me0YBdtGP5KiHb', 's2AVyoetjRm1PGagNWs', 'D7tr4HeClk3nPIc8Wnu'

Persistence and Installation Behavior
barindex
Creates processes via WMI
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Drops PE files with benign system names
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\Downloaded Program Files\lsass.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\SchCache\csrss.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Recovery\wininit.exe Jump to dropped file
Drops executable to a common third party application directory
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File written: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Jump to behavior
Drops executables to the windows directory (C:\Windows) and starts them
Source: unknown Executable created and started: C:\Windows\TAPI\WmiPrvSE.exe
Drops PE files
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Users\user\3D Objects\WmiPrvSE.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Users\Default\Downloads\upfc.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Recovery\qJBfikDNRbrkF.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\Downloaded Program Files\lsass.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Recovery\Registry.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Program Files (x86)\Windows Multimedia Platform\qJBfikDNRbrkF.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\SchCache\csrss.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\TAPI\WmiPrvSE.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Program Files\Common Files\qJBfikDNRbrkF.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Recovery\wininit.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Program Files\Windows Mail\qJBfikDNRbrkF.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\Temp\Crashpad\reports\WmiPrvSE.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\ProgramData\Packages\qJBfikDNRbrkF.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Users\Default\Desktop\qJBfikDNRbrkF.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Program Files (x86)\Windows Photo Viewer\en-GB\Idle.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\ProgramData\Packages\qJBfikDNRbrkF.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\Downloaded Program Files\lsass.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\SchCache\csrss.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\TAPI\WmiPrvSE.exe Jump to dropped file
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File created: C:\Windows\Temp\Crashpad\reports\WmiPrvSE.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qJBfikDNRbrkFq" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\qJBfikDNRbrkF.exe'" /f
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\wininit.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\TAPI\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Memory allocated: 1590000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Memory allocated: 1AF20000 memory reserve | memory write watch Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Memory allocated: B50000 memory reserve | memory write watch Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Memory allocated: 1A970000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Memory allocated: BB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Memory allocated: 1A6D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Recovery\wininit.exe Memory allocated: FC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Recovery\wininit.exe Memory allocated: 1A8E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Recovery\wininit.exe Memory allocated: 880000 memory reserve | memory write watch
Source: C:\Recovery\wininit.exe Memory allocated: 1A590000 memory reserve | memory write watch
Source: C:\Windows\TAPI\WmiPrvSE.exe Memory allocated: 1520000 memory reserve | memory write watch
Source: C:\Windows\TAPI\WmiPrvSE.exe Memory allocated: 1B050000 memory reserve | memory write watch
Source: C:\Windows\TAPI\WmiPrvSE.exe Memory allocated: 1400000 memory reserve | memory write watch
Source: C:\Windows\TAPI\WmiPrvSE.exe Memory allocated: 1ADF0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Recovery\wininit.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Recovery\wininit.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\TAPI\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\TAPI\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Window / User API: threadDelayed 1656 Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Window / User API: threadDelayed 548 Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Window / User API: threadDelayed 369 Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Window / User API: threadDelayed 369 Jump to behavior
Source: C:\Recovery\wininit.exe Window / User API: threadDelayed 367 Jump to behavior
Source: C:\Recovery\wininit.exe Window / User API: threadDelayed 365
Source: C:\Windows\TAPI\WmiPrvSE.exe Window / User API: threadDelayed 365
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe TID: 5772 Thread sleep count: 1656 > 30 Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe TID: 5772 Thread sleep count: 548 > 30 Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe TID: 648 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe TID: 7972 Thread sleep count: 369 > 30 Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe TID: 7680 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe TID: 7872 Thread sleep count: 369 > 30 Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe TID: 7732 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Recovery\wininit.exe TID: 8104 Thread sleep count: 367 > 30 Jump to behavior
Source: C:\Recovery\wininit.exe TID: 7832 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Recovery\wininit.exe TID: 7856 Thread sleep count: 365 > 30
Source: C:\Recovery\wininit.exe TID: 7652 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\TAPI\WmiPrvSE.exe TID: 8128 Thread sleep count: 365 > 30
Source: C:\Windows\TAPI\WmiPrvSE.exe TID: 7860 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\TAPI\WmiPrvSE.exe TID: 8096 Thread sleep count: 345 > 30
Source: C:\Windows\TAPI\WmiPrvSE.exe TID: 7740 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Recovery\wininit.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Recovery\wininit.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\TAPI\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\TAPI\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Recovery\wininit.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Recovery\wininit.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\TAPI\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\TAPI\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: jC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: pC:\Windows\WinSxS\amd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.867_none_b57fce26790eec13
Source: DVuCnBrdbI.exe, 00000000.00000002.1691493456.000000001C55B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}g?
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: lC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: sC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid.resources_31bf3856ad364e35_10.0.19041.1_en-us_447494df1222bcd8
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dC:\Windows\WinSxS\amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tC:\Windows\WinSxS\amd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: lC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: fC:\Windows\WinSxS\amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: oC:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: mC:\Windows\WinSxS\amd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd621127
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: wC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: mC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: cC:\Windows\WinSxS\amd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vC:\Windows\WinSxS\amd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a67
Source: DVuCnBrdbI.exe, 00000000.00000002.1690891623.000000001C43F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: pC:\Windows\WinSxS\amd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: hC:\Windows\WinSxS\amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: aC:\Windows\WinSxS\amd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: sC:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tC:\Windows\WinSxS\amd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca8
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: pC:\Windows\WinSxS\amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dC:\Windows\WinSxS\amd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: rC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: mC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tC:\Windows\WinSxS\amd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tC:\Windows\WinSxS\amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: lC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: hC:\Windows\WinSxS\amd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: sC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: eC:\Windows\WinSxS\amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: wC:\Windows\WinSxS\amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tC:\Windows\WinSxS\amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: sC:\Windows\WinSxS\amd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203a
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: wC:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tC:\Windows\WinSxS\amd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: nC:\Windows\WinSxS\wow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: lC:\Windows\WinSxS\amd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8c
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: hC:\Windows\WinSxS\amd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: lC:\Windows\WinSxS\amd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bda
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tC:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_en-us_369e8b635061fdb3
Source: DVuCnBrdbI.exe, 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: uC:\Windows\WinSxS\amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process token adjusted: Debug Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Process token adjusted: Debug Jump to behavior
Source: C:\Recovery\wininit.exe Process token adjusted: Debug Jump to behavior
Source: C:\Recovery\wininit.exe Process token adjusted: Debug
Source: C:\Windows\TAPI\WmiPrvSE.exe Process token adjusted: Debug
Source: C:\Windows\TAPI\WmiPrvSE.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Process created: unknown unknown Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Queries volume information: C:\Users\user\Desktop\DVuCnBrdbI.exe VolumeInformation Jump to behavior
Source: C:\Recovery\qJBfikDNRbrkF.exe Queries volume information: C:\Recovery\qJBfikDNRbrkF.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe Queries volume information: C:\Program Files\Internet Explorer\qJBfikDNRbrkF.exe VolumeInformation Jump to behavior
Source: C:\Recovery\wininit.exe Queries volume information: C:\Recovery\wininit.exe VolumeInformation Jump to behavior
Source: C:\Recovery\wininit.exe Queries volume information: C:\Recovery\wininit.exe VolumeInformation
Source: C:\Windows\TAPI\WmiPrvSE.exe Queries volume information: C:\Windows\TAPI\WmiPrvSE.exe VolumeInformation
Source: C:\Windows\TAPI\WmiPrvSE.exe Queries volume information: C:\Windows\TAPI\WmiPrvSE.exe VolumeInformation
Source: C:\Users\user\Desktop\DVuCnBrdbI.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected DCRat
Source: Yara match File source: 00000000.00000002.1684981326.0000000003735000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1755394202.00000000026D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1755394202.000000000270D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1755435217.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.1750646364.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.1750646364.00000000029AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.1754740131.000000000291D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.1754740131.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1755435217.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1748954073.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1755299818.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1686893087.0000000012F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DVuCnBrdbI.exe PID: 764, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: qJBfikDNRbrkF.exe PID: 7436, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: qJBfikDNRbrkF.exe PID: 7460, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: wininit.exe PID: 7492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: wininit.exe PID: 7500, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WmiPrvSE.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WmiPrvSE.exe PID: 7560, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected DCRat
Source: Yara match File source: 00000000.00000002.1684981326.0000000003735000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1755394202.00000000026D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1755394202.000000000270D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1755435217.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.1750646364.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.1750646364.00000000029AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.1754740131.000000000291D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.1754740131.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1755435217.0000000002E2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1748954073.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1755299818.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1686893087.0000000012F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1684981326.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DVuCnBrdbI.exe PID: 764, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: qJBfikDNRbrkF.exe PID: 7436, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: qJBfikDNRbrkF.exe PID: 7460, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: wininit.exe PID: 7492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: wininit.exe PID: 7500, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WmiPrvSE.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WmiPrvSE.exe PID: 7560, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1431406 Sample: DVuCnBrdbI.exe Startdate: 25/04/2024 Architecture: WINDOWS Score: 100 32 Found malware configuration 2->32 34 Antivirus detection for dropped file 2->34 36 Antivirus / Scanner detection for submitted sample 2->36 38 12 other signatures 2->38 6 DVuCnBrdbI.exe 4 57 2->6         started        10 wininit.exe 2 2->10         started        12 qJBfikDNRbrkF.exe 3 2->12         started        14 4 other processes 2->14 process3 file4 24 C:\Windows\Temp\Crashpad\...\WmiPrvSE.exe, PE32 6->24 dropped 26 C:\Windows\TAPI\WmiPrvSE.exe, PE32 6->26 dropped 28 C:\Windows\SchCache\csrss.exe, PE32 6->28 dropped 30 14 other malicious files 6->30 dropped 40 Uses schtasks.exe or at.exe to add and modify task schedules 6->40 42 Creates processes via WMI 6->42 44 Drops PE files with benign system names 6->44 46 Drops executable to a common third party application directory 6->46 16 schtasks.exe 6->16         started        18 schtasks.exe 6->18         started        20 schtasks.exe 6->20         started        22 30 other processes 6->22 48 Antivirus detection for dropped file 10->48 50 Multi AV Scanner detection for dropped file 10->50 52 Machine Learning detection for dropped file 10->52 signatures5 process6
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://golovkcc.beget.tech/@==gbJBzYuFDT false
    		high