Windows Analysis Report
ywXeiXEvP2.exe

Overview

General Information

Sample name: ywXeiXEvP2.exe
renamed because original name is a hash value
Original sample name: a8a4603bc85e306e0fdd17655e4820e4.exe
Analysis ID: 1455415
MD5: a8a4603bc85e306e0fdd17655e4820e4
SHA1: 5aa5d092a699c319c4d000f61eb526445b11662d
SHA256: 4b7b7e697954f5882dd6d3e8ee6197bab6c445dbd3a5af1118caa0e1ad908a9a
Tags: DCRatexe
Infos:

Detection

DCRat, XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Snort IDS alert for network traffic
Yara detected DCRat
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Creates processes via WMI
Disable UAC(promptonsecuredesktop)
Disables UAC (registry)
Machine Learning detection for dropped file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Sigma detected: WScript or CScript Dropper
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a window with clipboard capturing capabilities
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: CurrentVersion NT Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://a0991799.xsph.ru/@=AjM2MDZ4kjN Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\RuntimeBroker.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Avira: detection malicious, Label: HEUR/AGEN.1305769
Source: C:\Program Files\Windows Photo Viewer\en-GB\UserOOBEBroker.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\XClient.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Roaming\XClient.exe Avira: detection malicious, Label: HEUR/AGEN.1305769
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\UGsUclNNu9UBh.vbe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\RuntimeBroker.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Uninstall Information\OfficeClickToRun.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\sihost.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Found malware configuration
Source: 00000008.00000002.1902459797.000000001290D000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: DCRat {"SCRT": "{\"9\":\">\",\"A\":\"_\",\"a\":\"#\",\"4\":\"&\",\"j\":\"`\",\"i\":\")\",\"0\":\"(\",\"o\":\"~\",\"D\":\"!\",\"k\":\"$\",\"y\":\"|\",\"h\":\"@\",\"Q\":\"-\",\"H\":\"%\",\"S\":\" \",\"d\":\"<\",\"M\":\"*\",\"3\":\",\",\"J\":\";\",\"L\":\".\",\"m\":\"^\"}", "PCRT": "{\"O\":\"^\",\"U\":\"*\",\"v\":\"(\",\"V\":\")\",\"5\":\"!\",\"M\":\",\",\"Q\":\"$\",\"h\":\"-\",\"0\":\"_\",\"T\":\"~\",\"W\":\"@\",\"j\":\".\",\"1\":\"#\",\"L\":\"%\",\"K\":\"|\",\"t\":\";\",\"y\":\">\",\"a\":\"<\",\"o\":\" \",\"B\":\"&\",\"u\":\"`\"}", "TAG": "", "MUTEX": "DCR_MUTEX-s86YqWdFI22lJKKIYeYT", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 2, "ASCFG": {"savebrowsersdatatosinglefile": true, "ignorepartiallyemptydata": true, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": true, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%UsersFolder% - Fast"}, "AS": true, "ASO": false, "AD": false, "H1": "http://a0991799.xsph.ru/@=AjM2MDZ4kjN", "H2": "http://a0991799.xsph.ru/@=AjM2MDZ4kjN", "T": "0"}
Source: 1.0.Result.exe.7c9678.2.raw.unpack Malware Configuration Extractor: Xworm {"C2 url": ["127.0.0.1", "letter-takes.gl.at.ply.gg"], "Port": "50230", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\RuntimeBroker.exe ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe ReversingLabs: Detection: 87%
Source: C:\Program Files\Uninstall Information\OfficeClickToRun.exe ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Multimedia Platform\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Photo Viewer\en-GB\RuntimeBroker.exe ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Photo Viewer\en-GB\UserOOBEBroker.exe ReversingLabs: Detection: 87%
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe ReversingLabs: Detection: 87%
Source: C:\Recovery\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe ReversingLabs: Detection: 87%
Source: C:\Recovery\XClient.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe ReversingLabs: Detection: 72%
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe ReversingLabs: Detection: 94%
Source: C:\Users\user\AppData\Local\Temp\XClient.exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\sihost.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Roaming\XClient.exe ReversingLabs: Detection: 95%
Source: C:\Windows\ELAMBKUP\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe ReversingLabs: Detection: 87%
Source: C:\Windows\IME\IMEKR\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe ReversingLabs: Detection: 87%
Source: C:\Windows\IdentityCRL\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe ReversingLabs: Detection: 87%
Multi AV Scanner detection for submitted file
Source: ywXeiXEvP2.exe ReversingLabs: Detection: 73%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 98.5% probability
Machine Learning detection for dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\RuntimeBroker.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Joe Sandbox ML: detected
Source: C:\Program Files\Windows Photo Viewer\en-GB\UserOOBEBroker.exe Joe Sandbox ML: detected
Source: C:\Recovery\XClient.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\XClient.exe Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\RuntimeBroker.exe Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Joe Sandbox ML: detected
Source: C:\Program Files\Uninstall Information\OfficeClickToRun.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\sihost.exe Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 1.0.Result.exe.7c9678.2.raw.unpack String decryptor: 127.0.0.1,letter-takes.gl.at.ply.gg
Source: 1.0.Result.exe.7c9678.2.raw.unpack String decryptor: 50230
Source: 1.0.Result.exe.7c9678.2.raw.unpack String decryptor: <123456789>
Source: 1.0.Result.exe.7c9678.2.raw.unpack String decryptor: <Xwormmm>
Source: 1.0.Result.exe.7c9678.2.raw.unpack String decryptor: XWorm V5.6
Source: 1.0.Result.exe.7c9678.2.raw.unpack String decryptor: USB.exe
Source: 1.0.Result.exe.7c9678.2.raw.unpack String decryptor: %AppData%
Source: 1.0.Result.exe.7c9678.2.raw.unpack String decryptor: XClient.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\d908c538d2e8d0
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Multimedia Platform\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Multimedia Platform\d908c538d2e8d0
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\UserOOBEBroker.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\7ccfebd9e92364
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\RuntimeBroker.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\9e8d7a4ca61bd9
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Uninstall Information\OfficeClickToRun.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Uninstall Information\e6c9b481da804f
Source: ywXeiXEvP2.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Result.exe
Source: Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdbU.o. a._CorDllMainmscoree.dll source: ServerWeb.exe, 00000008.00000002.2226889345.000000001BF70000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdb source: ServerWeb.exe, 00000008.00000002.2226889345.000000001BF70000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: ywXeiXEvP2.exe
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C018647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7C018647C
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C019ECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7C019ECE0
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01B3130 FindFirstFileExA, 0_2_00007FF7C01B3130
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008DA5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 2_2_008DA5F4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008EB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 2_2_008EB8E0

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855924 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.4:53174 -> 147.185.221.19:50230
Source: Traffic Snort IDS: 2853193 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.4:53194 -> 147.185.221.19:50230
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 127.0.0.1
Source: Malware configuration extractor URLs: letter-takes.gl.at.ply.gg
Source: Malware configuration extractor URLs: http://a0991799.xsph.ru/@=AjM2MDZ4kjN
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:53164 -> 147.185.221.19:50230
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 147.185.221.19 147.185.221.19
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SALSGIVERUS SALSGIVERUS
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: letter-takes.gl.at.ply.gg
Source: XClient.exe, 00000003.00000002.4161351133.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, ServerWeb.exe, 00000008.00000002.1889481824.0000000002901000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Window created: window name: CLIPBRDWNDCLASS

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Result.exe, type: SAMPLE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.3.Result.exe.b10a30.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.0.Result.exe.7c9678.2.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.0.XClient.exe.480000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.0.Result.exe.7c9678.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.3.Result.exe.b10a30.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.Result.exe.b08218.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.0.Result.exe.466afd.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.0.Result.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.0.Result.exe.415eec.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000003.1702782236.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000000.1702689242.0000000000482000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000002.1703441913.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1719076090.00007FF7C01D6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000000.1684955911.0000000000408000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008D718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW, 2_2_008D718C
Creates files inside the system directory
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\IdentityCRL\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\IdentityCRL\d908c538d2e8d0
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\IME\IMEKR\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\IME\IMEKR\d908c538d2e8d0
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\ELAMBKUP\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\ELAMBKUP\d908c538d2e8d0
Detected potential crypto function
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01A09D8 0_2_00007FF7C01A09D8
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C0196294 0_2_00007FF7C0196294
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C018DC4C 0_2_00007FF7C018DC4C
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C019ECE0 0_2_00007FF7C019ECE0
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C019569C 0_2_00007FF7C019569C
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01A400C 0_2_00007FF7C01A400C
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C018A8AC 0_2_00007FF7C018A8AC
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C018B948 0_2_00007FF7C018B948
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C018E91C 0_2_00007FF7C018E91C
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01A400C 0_2_00007FF7C01A400C
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01B59E0 0_2_00007FF7C01B59E0
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C019CA30 0_2_00007FF7C019CA30
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01872AC 0_2_00007FF7C01872AC
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C018B318 0_2_00007FF7C018B318
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01B5510 0_2_00007FF7C01B5510
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01AFD18 0_2_00007FF7C01AFD18
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01ABDF8 0_2_00007FF7C01ABDF8
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C018BF0C 0_2_00007FF7C018BF0C
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01B2F24 0_2_00007FF7C01B2F24
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01B9008 0_2_00007FF7C01B9008
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01AC074 0_2_00007FF7C01AC074
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008D857B 2_2_008D857B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008E70BF 2_2_008E70BF
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008FD00E 2_2_008FD00E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008D407E 2_2_008D407E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_00901194 2_2_00901194
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008D3281 2_2_008D3281
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008DE2A0 2_2_008DE2A0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008F02F6 2_2_008F02F6
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008E6646 2_2_008E6646
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008E37C1 2_2_008E37C1
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008D27E8 2_2_008D27E8
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008F070E 2_2_008F070E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008F473A 2_2_008F473A
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008DE8A0 2_2_008DE8A0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008DF968 2_2_008DF968
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008F4969 2_2_008F4969
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008E3A3C 2_2_008E3A3C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008E6A7B 2_2_008E6A7B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008F0B43 2_2_008F0B43
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008FCB60 2_2_008FCB60
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008E5C77 2_2_008E5C77
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008EFDFA 2_2_008EFDFA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008DED14 2_2_008DED14
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008E3D6D 2_2_008E3D6D
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008DBE13 2_2_008DBE13
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008DDE6C 2_2_008DDE6C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008D5F3C 2_2_008D5F3C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008F0F78 2_2_008F0F78
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Code function: 3_2_00007FFD9B7C6406 3_2_00007FFD9B7C6406
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Code function: 3_2_00007FFD9B7C05A0 3_2_00007FFD9B7C05A0
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Code function: 3_2_00007FFD9B7C71B2 3_2_00007FFD9B7C71B2
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Code function: 8_2_00007FFD9B803555 8_2_00007FFD9B803555
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Code function: 8_2_00007FFD9B815B00 8_2_00007FFD9B815B00
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Code function: 37_2_00007FFD9B7C3555 37_2_00007FFD9B7C3555
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Code function: 38_2_00007FFD9B7C3555 38_2_00007FFD9B7C3555
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B8033AC 41_2_00007FFD9B8033AC
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B80C740 41_2_00007FFD9B80C740
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B802B20 41_2_00007FFD9B802B20
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B802B20 41_2_00007FFD9B802B20
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B802B20 41_2_00007FFD9B802B20
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B802B20 41_2_00007FFD9B802B20
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\RuntimeBroker.exe B59342163EA5752E627B1EB236F42A9882F15FDFF96CA77EBA7B20E416F4A4F3
Source: Joe Sandbox View Dropped File: C:\Program Files (x86)\jDownloader\config\conhost.exe B59342163EA5752E627B1EB236F42A9882F15FDFF96CA77EBA7B20E416F4A4F3
Source: Joe Sandbox View Dropped File: C:\Program Files\Uninstall Information\OfficeClickToRun.exe B59342163EA5752E627B1EB236F42A9882F15FDFF96CA77EBA7B20E416F4A4F3
Source: Joe Sandbox View Dropped File: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe B59342163EA5752E627B1EB236F42A9882F15FDFF96CA77EBA7B20E416F4A4F3
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: String function: 008EE28C appears 35 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: String function: 008EE360 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: String function: 008EED00 appears 31 times
PE file contains executable resources (Code or Archives)
Source: Result.exe.0.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Result.exe.0.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: Result.exe.0.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ServerWeb.exe.2.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Sample file is different than original file name gathered from version info
Source: ywXeiXEvP2.exe, 00000000.00000002.1719076090.00007FF7C01D6000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameXClient.exe4 vs ywXeiXEvP2.exe
Yara signature match
Source: Result.exe, type: SAMPLE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.3.Result.exe.b10a30.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.0.Result.exe.7c9678.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.0.XClient.exe.480000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.0.Result.exe.7c9678.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.3.Result.exe.b10a30.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.Result.exe.b08218.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.0.Result.exe.466afd.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.0.Result.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.0.Result.exe.415eec.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000003.1702782236.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000000.1702689242.0000000000482000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000002.1703441913.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1719076090.00007FF7C01D6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000000.1684955911.0000000000408000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: XClient.exe.1.dr, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.1.dr, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.1.dr, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.0.Result.exe.466afd.1.raw.unpack, ef7UDCGv7gcEUFZT1op.cs Cryptographic APIs: 'TransformBlock'
Source: 1.0.Result.exe.466afd.1.raw.unpack, ef7UDCGv7gcEUFZT1op.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.0.Result.exe.466afd.1.raw.unpack, g357BcsySpWm2aqpGZs.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.0.Result.exe.466afd.1.raw.unpack, g357BcsySpWm2aqpGZs.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.0.Result.exe.7c9678.2.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.0.Result.exe.7c9678.2.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.0.Result.exe.7c9678.2.raw.unpack, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.3.Result.exe.b10a30.1.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.3.Result.exe.b10a30.1.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.1.dr, Settings.cs Base64 encoded string: 'rBjz7U/o2BFlwrIwGW6YVD/jeOSVunTMlvpBAz8+qFFueMbxy0zRw9MoYV6Lr0cj'
Source: 1.0.Result.exe.7c9678.2.raw.unpack, Settings.cs Base64 encoded string: 'rBjz7U/o2BFlwrIwGW6YVD/jeOSVunTMlvpBAz8+qFFueMbxy0zRw9MoYV6Lr0cj'
Source: 1.3.Result.exe.b10a30.1.raw.unpack, Settings.cs Base64 encoded string: 'rBjz7U/o2BFlwrIwGW6YVD/jeOSVunTMlvpBAz8+qFFueMbxy0zRw9MoYV6Lr0cj'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, fCvAaGJbOISiMM9DuTO.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.3.Result.exe.2642c39.0.raw.unpack, fCvAaGJbOISiMM9DuTO.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.0.Result.exe.466afd.1.raw.unpack, fCvAaGJbOISiMM9DuTO.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.0.Result.exe.466afd.1.raw.unpack, fCvAaGJbOISiMM9DuTO.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.3.Result.exe.b10a30.1.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.3.Result.exe.b10a30.1.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: XClient.exe.1.dr, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XClient.exe.1.dr, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.0.Result.exe.7c9678.2.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.0.Result.exe.7c9678.2.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.evad.winEXE@48/39@1/2
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C0183BF8 GetLastError,FormatMessageW,LocalFree, 0_2_00007FF7C0183BF8
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C019C260 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 0_2_00007FF7C019C260
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe File created: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Mutant created: \Sessions\1\BaseNamedObjects\ke4QYmw58n6HyeTA
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\e78b700b17b507eb7e67e7d398bae13027208301
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7444:120:WilError_03
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe File created: C:\Users\user\AppData\Local\Temp\RarSFX0 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\hUqNkgIMv7nY24UYezK0etl.bat" "
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\file.vbs"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Command line argument: sfxname 2_2_008ED5D4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Command line argument: sfxstime 2_2_008ED5D4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Command line argument: STARTDLG 2_2_008ED5D4
Source: ywXeiXEvP2.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: ywXeiXEvP2.exe ReversingLabs: Detection: 73%
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe File read: C:\Users\user\Desktop\ywXeiXEvP2.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\ywXeiXEvP2.exe "C:\Users\user\Desktop\ywXeiXEvP2.exe"
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe"
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Process created: C:\Users\user\AppData\Local\Temp\XClient.exe "C:\Users\user\AppData\Local\Temp\XClient.exe"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\UGsUclNNu9UBh.vbe"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\file.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\hUqNkgIMv7nY24UYezK0etl.bat" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe "C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe"
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwH" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\RuntimeBroker.exe'" /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 6 /tr "'C:\Recovery\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwH" /sc ONLOGON /tr "'C:\Recovery\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 8 /tr "'C:\Recovery\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwH" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\user\SendTo\sihost.exe'" /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\user\SendTo\sihost.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\user\SendTo\sihost.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\jdownloader\config\conhost.exe'" /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\jdownloader\config\conhost.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\jdownloader\config\conhost.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 6 /tr "'C:\Recovery\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwH" /sc ONLOGON /tr "'C:\Recovery\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 14 /tr "'C:\Recovery\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwH" /sc ONLOGON /tr "'C:\Users\All Users\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: unknown Process created: C:\Program Files (x86)\jDownloader\config\conhost.exe "C:\Program Files (x86)\jdownloader\config\conhost.exe"
Source: unknown Process created: C:\Program Files (x86)\jDownloader\config\conhost.exe "C:\Program Files (x86)\jdownloader\config\conhost.exe"
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 10 /tr "'C:\Windows\IdentityCRL\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /f
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwH" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: unknown Process created: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe "C:\Users\All Users\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe"
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Process created: C:\Users\user\AppData\Local\Temp\XClient.exe "C:\Users\user\AppData\Local\Temp\XClient.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\UGsUclNNu9UBh.vbe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\file.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\hUqNkgIMv7nY24UYezK0etl.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe "C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 8 /tr "'C:\Recovery\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: <pi-ms-win-core-localization-l1-2-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: apphelp.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: version.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: version.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: mscoree.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: apphelp.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: version.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: wldp.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: profapi.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\d908c538d2e8d0
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Multimedia Platform\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Multimedia Platform\d908c538d2e8d0
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\UserOOBEBroker.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\7ccfebd9e92364
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\RuntimeBroker.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Windows Photo Viewer\en-GB\9e8d7a4ca61bd9
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Uninstall Information\OfficeClickToRun.exe
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Directory created: C:\Program Files\Uninstall Information\e6c9b481da804f
Source: ywXeiXEvP2.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: ywXeiXEvP2.exe Static file information: File size 3817238 > 1048576
Source: ywXeiXEvP2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ywXeiXEvP2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ywXeiXEvP2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ywXeiXEvP2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ywXeiXEvP2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ywXeiXEvP2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: ywXeiXEvP2.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: ywXeiXEvP2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Result.exe
Source: Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdbU.o. a._CorDllMainmscoree.dll source: ServerWeb.exe, 00000008.00000002.2226889345.000000001BF70000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdb source: ServerWeb.exe, 00000008.00000002.2226889345.000000001BF70000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: ywXeiXEvP2.exe
Source: ywXeiXEvP2.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ywXeiXEvP2.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ywXeiXEvP2.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ywXeiXEvP2.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ywXeiXEvP2.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: XClient.exe.1.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.1.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.0.Result.exe.466afd.1.raw.unpack, g357BcsySpWm2aqpGZs.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.0.Result.exe.7c9678.2.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.0.Result.exe.7c9678.2.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.3.Result.exe.b10a30.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.3.Result.exe.b10a30.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.3.Result.exe.2642c39.0.raw.unpack, g357BcsySpWm2aqpGZs.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: XClient.exe.1.dr, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: XClient.exe.1.dr, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: XClient.exe.1.dr, Messages.cs .Net Code: Memory
Source: 1.0.Result.exe.466afd.1.raw.unpack, KtgOgEaZxpZ7Xqg6q3Q.cs .Net Code: ITEJwc17La System.AppDomain.Load(byte[])
Source: 1.0.Result.exe.466afd.1.raw.unpack, KtgOgEaZxpZ7Xqg6q3Q.cs .Net Code: ITEJwc17La System.Reflection.Assembly.Load(byte[])
Source: 1.0.Result.exe.466afd.1.raw.unpack, KtgOgEaZxpZ7Xqg6q3Q.cs .Net Code: ITEJwc17La
Source: 1.0.Result.exe.7c9678.2.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 1.0.Result.exe.7c9678.2.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 1.0.Result.exe.7c9678.2.raw.unpack, Messages.cs .Net Code: Memory
Source: 1.3.Result.exe.b10a30.1.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 1.3.Result.exe.b10a30.1.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 1.3.Result.exe.b10a30.1.raw.unpack, Messages.cs .Net Code: Memory
Source: 1.3.Result.exe.2642c39.0.raw.unpack, KtgOgEaZxpZ7Xqg6q3Q.cs .Net Code: ITEJwc17La System.AppDomain.Load(byte[])
Source: 1.3.Result.exe.2642c39.0.raw.unpack, KtgOgEaZxpZ7Xqg6q3Q.cs .Net Code: ITEJwc17La System.Reflection.Assembly.Load(byte[])
Source: 1.3.Result.exe.2642c39.0.raw.unpack, KtgOgEaZxpZ7Xqg6q3Q.cs .Net Code: ITEJwc17La
File is packed with WinRar
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_4904046 Jump to behavior
PE file contains an invalid checksum
Source: ServerWeb.exe.2.dr Static PE information: real checksum: 0x0 should be: 0x365f40
Source: DCRatBuild.exe.1.dr Static PE information: real checksum: 0x0 should be: 0x3b9eb6
Source: Result.exe.0.dr Static PE information: real checksum: 0x1c302 should be: 0x3e11a9
Source: ywXeiXEvP2.exe Static PE information: real checksum: 0x0 should be: 0x3ade12
Source: XClient.exe.1.dr Static PE information: real checksum: 0x0 should be: 0x1684f
PE file contains sections with non-standard names
Source: ywXeiXEvP2.exe Static PE information: section name: .didat
Source: ywXeiXEvP2.exe Static PE information: section name: _RDATA
Source: DCRatBuild.exe.1.dr Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008EE28C push eax; ret 2_2_008EE2AA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008EED46 push ecx; ret 2_2_008EED59
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Code function: 3_2_00007FFD9B7C00AD pushad ; iretd 3_2_00007FFD9B7C00C1
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Code function: 8_2_00007FFD9B802BB5 pushad ; retf 8_2_00007FFD9B802C41
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Code function: 8_2_00007FFD9B802BC2 pushad ; retf 8_2_00007FFD9B802C41
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Code function: 8_2_00007FFD9B827567 push ebx; iretd 8_2_00007FFD9B82756A
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Code function: 8_2_00007FFD9BAEB0AB push es; retn 7002h 8_2_00007FFD9BAEB519
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Code function: 8_2_00007FFD9BAE7AFF push cs; ret 8_2_00007FFD9BAE7C1F
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Code function: 8_2_00007FFD9BAE7B1F push cs; ret 8_2_00007FFD9BAE7C1F
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Code function: 37_2_00007FFD9B7C2BB5 pushad ; retf 37_2_00007FFD9B7C2C41
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Code function: 37_2_00007FFD9B7C2BC2 pushad ; retf 37_2_00007FFD9B7C2C41
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Code function: 38_2_00007FFD9B7C2B90 pushad ; retf 38_2_00007FFD9B7C2C41
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Code function: 38_2_00007FFD9B7C2BB5 pushad ; retf 38_2_00007FFD9B7C2C41
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Code function: 38_2_00007FFD9B7C2BC2 pushad ; retf 38_2_00007FFD9B7C2C41
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Code function: 38_2_00007FFD9B7C71E5 push es; iretd 38_2_00007FFD9B7C71E8
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Code function: 38_2_00007FFD9B7C7DC3 push ds; ret 38_2_00007FFD9B7C7DC4
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B802C00 pushad ; retf 41_2_00007FFD9B802C41
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B802BB5 pushad ; retf 41_2_00007FFD9B802C41
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B802B58 pushad ; retf 41_2_00007FFD9B802C41
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B8071E5 push es; iretd 41_2_00007FFD9B8071E8
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Code function: 41_2_00007FFD9B807DC3 push ds; ret 41_2_00007FFD9B807DC4
Source: 1.0.Result.exe.466afd.1.raw.unpack, J9jqRkoToht6Axav6f.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'NeRaBUW1ToiQmqY3Rwp', 'cxiZinWj72nVAdcXFtW', 'T56YhrWMh1osaNqOjHR', 'BDYUL8WqNK0k69O2F5E', 'RNK64NWUJi0mjGC8VyL', 'OP10UKWnaks2Z2AOno0'
Source: 1.0.Result.exe.466afd.1.raw.unpack, TlC0uIJA6jdOfUly0tI.cs High entropy of concatenated method names: 'sg9', 'wWeT2aUocN', 'gduZMimUvT', 'NsbTJxswQ9', 'As1xPKrNyMaueOxExPs', 'pWD3APreyNI2m78JVuI', 'shknFTrFElF90iBIH8P', 'aRjImNr4RCOIkcgPCHw', 'O4xtRKrZ94mH3hVpF8j', 'hA8HtDrQvG9hgiwankP'
Source: 1.0.Result.exe.466afd.1.raw.unpack, W4xCsmJwFAc4CDRMHoT.cs High entropy of concatenated method names: 'KsvmIppiaB', 'Yo0mUc4SBs', 'jH0m3y6rGI', 'OTnmDvIaAB', 'jrnAKc9G447b270KKiT', 'vJ3mXx9C1n90Bua2BQt', 'Ue3DHg9fQhxijGYHUlH', 'iARrC49TL2yxMF6kqyM', 'CxuSBE9t4J44ncF6Uib', 'pnuppE93T9yhSy8suha'
Source: 1.0.Result.exe.466afd.1.raw.unpack, xWhDIfGh8PApjqkB3ox.cs High entropy of concatenated method names: 'Ik2tedcZ04', 'Om3ApNxsKqbW3n51uul', 'zdQZgoxBJFAGuUsfbH8', 'NG2iqBxmykD2tUFp9QB', 'avWtdSxyyegeVgngFdY', '_1fi', 'vX7SoIoDFB', '_676', 'IG9', 'mdP'
Source: 1.0.Result.exe.466afd.1.raw.unpack, z2U5t67BwbnoCjPv4Xh.cs High entropy of concatenated method names: '_7zt', 'ul0Lbsx9jl', 'uBWLOCSa2v', 'wvvLdoHtGD', 'tCDLNJT1D0', 'ljELcmUEcg', 'pmdLEcOYDb', 'y7k8cLVrPEIuYX3PGjU', 'sdWW35VLZ4kEC7IsFUC', 'la9BpTV93MMxWANCjIr'
Source: 1.0.Result.exe.466afd.1.raw.unpack, LNcjaT7FXIwmyJicO5F.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 1.0.Result.exe.466afd.1.raw.unpack, x1G6pPDFtsh863ctT4.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'yqpQNVwx5g8fPmLxMCe', 'RhEWc7wgLklpOhO4MWA', 'qPaFTnw4Pa51WPWJeNe', 'qPVxQowZALaoCFqIoGH', 'R7kOyAwNFpCL1y1lM6L', 'n2PpPYweQZBQ1uhDVeB'
Source: 1.0.Result.exe.466afd.1.raw.unpack, YbgphxG5g9Jw5XMqvfv.cs High entropy of concatenated method names: 'Ieg1cRKl0u', '_1kO', '_9v4', '_294', 'B3E1EoZqlq', 'euj', 'WoR1qHBuiF', 'Ly31VcWfEE', 'o87', 'BMo1kEXC9F'
Source: 1.0.Result.exe.466afd.1.raw.unpack, LA0jeR7ctquxODXu7MJ.cs High entropy of concatenated method names: 'xeQ7kMVgaWIN9T1cJBo', 'fRvpU0V4ivCGHqAqpL9', 'iuwbFgVZEK2aHwLGsGf', 'meCvnIVEB3HujW43LW7', 'cCZZuYVxrMQSjtJSank'
Source: 1.0.Result.exe.466afd.1.raw.unpack, zsa8dOGEncbuD7NjZD3.cs High entropy of concatenated method names: 'IGD', 'CV5', 'fU7kqHZXS8', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 1.0.Result.exe.466afd.1.raw.unpack, vfjP2WstDoN9mO43WJ.cs High entropy of concatenated method names: 'TP2yWtDoN', 'IkxFySth9nD3whLt97', 'PBl4e1BjKXOigQKa02', 'CS0eFKTlJVOsvec85V', 'Uq6nQlG74RHq6By2xe', 'IQuS2JCnJ7NsHFCat7', 'usSaTkVf2', 'QblJnL1ll', 'NWk769qq6', 'Xp4RZ0tii'
Source: 1.0.Result.exe.466afd.1.raw.unpack, KtgOgEaZxpZ7Xqg6q3Q.cs High entropy of concatenated method names: 'Bx1JTvsBI3', 'axWJXM5GUp', 'HqOJQDuXeF', 'NatJpQXDBx', 'U7fJhZuoVp', 'j1FJeTfc2c', 'tHLJfWMGkX', 'rCnSXJkHRmil7MaF6wq', 'zDe4lOkryOOR7oWTUJh', 'PTXpl7kLDJsChlQml37'
Source: 1.0.Result.exe.466afd.1.raw.unpack, RtainsGW4fxAhFbG8mU.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'Jo19VKUunB', 'QpH9ke6yvx', 'ikD99iHbbt', 'd7Q9SGmiwK', 'StI9tbeh23', 'AGR91hbTCp', 'BtuFXpE3Sj6CGHhFk7A'
Source: 1.0.Result.exe.466afd.1.raw.unpack, mv5PHLacBSFYVLFlVtf.cs High entropy of concatenated method names: 'a8J7ddANZF', 'z5K7NLqrcy', 'HrT7c5HjGV', 'Ur67EVZIcl', 'Mqr7q6ry60', 'a09Zc1jlQ5Fkp1Jt3el', 'lrMuNTjptBcusK9YmRb', 'a19V3F1dDI181KJgMCW', 'nA0ijV1z9b9hdKZEkE0', 'j75MhLj56UkFDk6RXal'
Source: 1.0.Result.exe.466afd.1.raw.unpack, NrTABiMLvMcu3Am0Ss.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'dT129dW8EocRGopwult', 'ds5s1cWSaUEsRvsxJAP', 'X88anOWabYXJV5SBjK7', 'LtZ54PWJO2n0NfYEIVc', 'VAhsliWoaN0XlikE5dw', 'toJ22wWdYbwahnCG4EI'
Source: 1.0.Result.exe.466afd.1.raw.unpack, OTnvIa7ZABiAU1abijT.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 1.0.Result.exe.466afd.1.raw.unpack, JUVOIm7RlYOijLikpvR.cs High entropy of concatenated method names: 'TteKxUdyOO', 'wZtunFcUkQJOoOFbOYk', 'Qq4QUXcnuMXKffT3Pq2', 'hQrsg7cMlG5o9pwAnJS', 'pDDTJmcqtZoQvqkdDFY', 'VlLCimatXa', 'ficCWjMZEv', 'abWCTCW0oa', 'KOnCX3ghAF', 'gNiCQbsCLB'
Source: 1.0.Result.exe.466afd.1.raw.unpack, J7G5cQGNO049YArLSx8.cs High entropy of concatenated method names: 'qkZkO5X4QS', 'cfokdOAgOt', 'AUnkN3lcV1', 'XHYkcasMv4', 't63kEQ6qTp', 'duxUXM0JtyRW44EHpj6', 'zkcGv50oXgjgonrWr4A', 'hIpwoC0dHeSqWb3IpLP', 'E9DurO0z2kngWE0GhYd', 'rMUvxZYlTUnbwSGXEju'
Source: 1.0.Result.exe.466afd.1.raw.unpack, lGIwbmGXEyGlkwZ4fNQ.cs High entropy of concatenated method names: 'aqdCpExwqlDruXWT4i3', 'eKr7uvxWiTm6lFgTDoQ', 'JcBmFfx5AZZhF9Ko9MP', 'BwQmvjxAYuUn8HKa1ON', 'MoK9QKmwKx', 'WM4', '_499', 'BOH9poeXOq', 'Iym9hiLCcv', 'RtJ9eKVVOO'
Source: 1.0.Result.exe.466afd.1.raw.unpack, iKm6ibax7bVYVLsjWVD.cs High entropy of concatenated method names: 'XLIJMD1G6D', 'IOIJnFdR0N', 'x2mFLS6ngyVfnx4wnmo', 'apgX0X6vKIJjsKhByhu', 'lOTYtt69eM0bw65xiUP', 'BRLpgR678bDO6RULWRK', 'MHYM5K6rAsdQOZY9ynr', 'KRQ0Jw6Ltb1Qs3kAX6r', 'B26FY96HbCfng2OA2lV', 'GuSCG66cW36wS9o8Wm9'
Source: 1.0.Result.exe.466afd.1.raw.unpack, s703IyRjy6OOtM6MNFo.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 1.0.Result.exe.466afd.1.raw.unpack, p8kJJFJoqqCLtyZGyuA.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'rhvCFbsPN8', 'LRfTlF7s2H', 'oDrCKnMnTr', 'OKGTA7S6tn', 'JUVsSRLKMCdAoDZ2E8s', 'EyCMYfLR4EWgf5dnOB1', 'jvuEKULfnZ3jlps75ku'
Source: 1.0.Result.exe.466afd.1.raw.unpack, vLS2q9Rno100QGIcjAB.cs High entropy of concatenated method names: 'vpJVSYBDqc', 'RkKVtWD1xv', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'TAbV10ABwK', '_5f9', 'A6Y'
Source: 1.0.Result.exe.466afd.1.raw.unpack, kcYm2yAxiu8duiBOo3.cs High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'FR0EvjwOfJt4LTiakre', 'trY9aiwPykcg5DAFO82', 'aEdEWIwhuyrMDphvTFD', 'lFRhOrwkhvvttQcL7Yy', 'ztPYSUw6cZGNpjoRteG', 'cBtVTVw1OaVOiZGZk4C'
Source: 1.0.Result.exe.466afd.1.raw.unpack, MywuO0ecBIEDWkejmN.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'V2Ih4YAf3GPHWR9W79M', 'ljZu5fA3nWpx3iyxV8J', 'DMr8OVAKtOxE8KgVOD0', 'sHVIOhARgHOatl6Xv9h', 'EnpilrA0k7U6PHZqmoR', 'LylQ69AYdVrdeVf4J0C'
Source: 1.0.Result.exe.466afd.1.raw.unpack, rHt7uMJCfWa9UHePPBG.cs High entropy of concatenated method names: 'RSXmXJTWCT', 'zeFmQ34xTc', 'MyDmpVtx3v', 'r2gMmd96TEsbkAmpEtR', 'V3oX6i9hoRq5vFZsXjC', 'a45LGk9kmUhfG56fb54', 'hB3FLF912jKHsxyg6mD', 'Qnmm2DFJ85', 'dEAmrLVT13', 'McPmxMbPGD'
Source: 1.0.Result.exe.466afd.1.raw.unpack, WcHawNutdttSSVMdLiu.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'DtiAUybfglg1rI2lxEa', 'avXXLob3sThGvOOyXf4', 'C1m3xcbKqALkaHyr02u', 'jpwmGGbR9ECWEfRt32G', 'aKv6Y0b0Kilh7vaPRK4', 'IuTffrbYIPYwLOMscqB'
Source: 1.0.Result.exe.466afd.1.raw.unpack, BHb0VlGaagfBmK20jUO.cs High entropy of concatenated method names: 'mD7kmaKj58', 'NmjkZxMgLf', '_8r1', 'tiukCDPQXf', 'W1UkFOj7TG', 'RVqkKMqLTC', 'd8hkL9vqb7', 'Vc6FlX0jVgtAkSOeLJT', 'HgVEV20MX3Nxi60O2Bh', 'H1VpXo0qw8TKhVfW4rN'
Source: 1.0.Result.exe.466afd.1.raw.unpack, ef7UDCGv7gcEUFZT1op.cs High entropy of concatenated method names: 'EARV3OyIYC', 'IJ4VDKoCx0', 'cErVHCNGBZ', 'ryDVgQK08h', 'jKMV5L5PGV', 'QSjVoAYUOg', '_838', 'vVb', 'g24', '_9oL'
Source: 1.0.Result.exe.466afd.1.raw.unpack, J0Qd22uZbby0hcTU85o.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'Xidlv6iidhPmlAyN6mU', 'P1MOZ3iDaU5ef7Qi494', 'iyDh2sib7THfe0NTKKi', 'iieZ9TiXe0IshoiWiKl', 'Gu5whiiOm1tcQKZUTUD', 'EJZ8qAiPL34sircwnja'
Source: 1.0.Result.exe.466afd.1.raw.unpack, sy9nlb4UjJR8gEsPiC.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'SnrNErAa8fQm6iVuCUe', 'x3n3fyAJQOPS2UyJ1IQ', 'X5LNUIAoCJXTKSaAQPf', 'Fl15a5Ad56UhGBpceEY', 'N4X4CQAzFKbU1tSoY4E', 'zZxSjAwlfybt4YBjRqe'
Source: 1.0.Result.exe.466afd.1.raw.unpack, PCKnhaJqFcgQEqef9I7.cs High entropy of concatenated method names: 'eZxZTAVhBN', 'bgRZXOj5Lk', 'MLgB0orUAfjlrdID2Mf', 'ODSMvZrnbieKPa5hUl8', 'jGJLCXrMgRXEtqROiY8', 'Qgo283rq7Gcv69poj2C', 'HB7NCUrv7VYfosJupxK', 'MQxgV4r9t3tTeOMiUSb'
Source: 1.0.Result.exe.466afd.1.raw.unpack, ff8RppJuiGtFdXf28Cx.cs High entropy of concatenated method names: 'JMCs1VcsXA', 'MDgsiJs4mA', 'aDosW7ZouH', 'LwGsTlkUSf', 'Xn6m2PUzvQZLX401N9M', 'pPx5wAUoAimPpCO1kdd', 'avJg16UdShgaOOJWU3U', 'rYB7MPnl7cfsJHyUDjb', 'ooIaLvnp4NZOCJmUqeY', 'QrWe5gn5UFReTyqZnw8'
Source: 1.0.Result.exe.466afd.1.raw.unpack, W6hetLuEAbhKOOpdNis.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'buRvaHDC5cd0felcx4t', 'o8YwRSDf7jevKmnUEwc', 'FvsMmpD3QUVkA3xr8Ky', 'egw2GGDKy6Oj4vbPwuw', 'AIQv3MDRTgeeY3ZNs0p', 'vm94hdD0VJ3bic8oQUU'
Source: 1.0.Result.exe.466afd.1.raw.unpack, jgeZRtuuWoVL5c6k13I.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'xbtWNw2n63NZBbWOgis', 'hhFgC12vm7GucRlqyyH', 'YJsHUW29nc5NZKpNXYv', 'bNLUD027x1aE4iaY9V1', 'sjpANu2reLArjoGryl0', 'ARyCkh2LS1RjHRC33oQ'
Source: 1.0.Result.exe.466afd.1.raw.unpack, yeQlmn7qaACEmCIw5Xr.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'lGIyvwbmEy', '_3il', 'flkyuwZ4fN', 'Gkyyan4Bhe', '_78N', 'z3K'
Source: 1.0.Result.exe.466afd.1.raw.unpack, rkWbSxue3YUmlTIaIta.cs High entropy of concatenated method names: 'XTsuM98IqV', 'VQW7J7X3nhI2cAr652f', 'SALUVSXKecWK7N0HLJ4', 'thImEjXCX7Ffj9dfJTE', 'IcBLirXfbEXoL4ySiS5', 'vphbTyXRAnH5rDaffAd', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 1.0.Result.exe.466afd.1.raw.unpack, fNCQZKGtx1VHEenG35h.cs High entropy of concatenated method names: 'rmP9Z5MjGy', 'FG19CsQjJU', 'M3J9FZWAgt', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'XXw9KXv23w'
Source: 1.0.Result.exe.466afd.1.raw.unpack, QqtijouQ8IvvqFJ7LPx.cs High entropy of concatenated method names: 'zqDuY7cqcN', 'nOhLjxXHBRMer6h1jM9', 'dG2oOJXcKWfXJj8yJoW', 'pRMZAUXroBKUMimmbXR', 'mluELyXL3uLZKoNBlJd', 'NBVK9aXVkrWWn09F27b', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 1.0.Result.exe.466afd.1.raw.unpack, g5HUDyJUtfPsndj7DmN.cs High entropy of concatenated method names: '_5u9', 'GCUT5S27ul', 'slwCvbAhGb', 'xyGToDs18J', 'aIk0jhrJbsXMP929EpM', 'cOwcgIroEegYLaBH46t', 'vflGPerd6yffLg731Vh', 'D76O4NrSbeg0WJcChrG', 'qvTWxGragFZbF3yKLNK', 'RHS7ArrzcEbRisiabRq'
Source: 1.0.Result.exe.466afd.1.raw.unpack, Ye9RruubYRRcCcTsZXs.cs High entropy of concatenated method names: 'nyxu1iu8du', 'SmHkmyDqYHf11oxfhsN', 'pNP058DUCaVLqCccnDL', 'pH6n8MDj3TJdIFbk0XK', 'aQ6UQdDMMqng1fFcVcL', 'VwiSnZDnuJdNNN7YZYx', 'PXblMlDvQTUueTjmySd', 'mAj8BsD9S7S90jpwpuY', 'JDC3iBD73XBdPXO6LFs', 'f28'
Source: 1.0.Result.exe.466afd.1.raw.unpack, pvDVj975CFnUK40X4EC.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'eP5w2DasP1', 'RM5wrDnPV5', 'r8j', 'LS1', '_55S'
Source: 1.0.Result.exe.466afd.1.raw.unpack, JelU0LJLqUaCCMtuWxf.cs High entropy of concatenated method names: '_223', 'CtHC3E9qtlvnlt2iFpS', 'gPvN3u9UMJDR8N8jnn6', 'uoDScJ9nFsYYDb0ZGb7', 'XkiVS59vFrKDGHWhT1c', 'nvw3Fi99L0jExOV614b', 'YRusbv97vHCQrBCENNb', 'dKacc69rICMeHB7HKci', 'IXyA5Y9LyuYEyjkCrmj', 'Ek844t9Hjrf9fJxn5xN'
Source: 1.0.Result.exe.466afd.1.raw.unpack, V9BBYX7xLOuqhxXjTMf.cs High entropy of concatenated method names: 'J5NL70skTh', 'yunLRlgP9Z', 'sQOLGatoOC', 'm1XGY8VMf1eO59JjFtI', 'Jv22w7VqeMiqPH3oRgj', 'sHd4hNV1GaRmV073Cyk', 'NtrSHoVjHaqe2k1nD3N', 'iF2uPkVUs8cfpfoIuk9', 'v33IgYVnqGZj3o9mTbc', 'PQxlJRVvmFNPjC7xxqN'
Source: 1.0.Result.exe.466afd.1.raw.unpack, qjbesxY1j409qD7cqc.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'I65A8jWmRkI6ynCHL9V', 'bTOgHiWy2YYW3MPYtia', 'qPFyyRWsGKygSJTY35u', 'GsUYAiWBij1JbPSU0JP', 'pbrd6NWTDhXPRuU5aap', 'T6ToYwWtrB4KUifCH9e'
Source: 1.0.Result.exe.466afd.1.raw.unpack, iFEE2ManVTRtGTQFLd9.cs High entropy of concatenated method names: 'CXwsVGJsVf', 'NwZ56WUFooG1JYmHA9r', 'YVNlLnUNAZbZ5kZkmFp', 'D6FSKBUeYNvMUk9JdiX', 't9JXbqUQ7tY8iUp61Hm', 'Obi3wWUIM14I81IywGF', 'gRPsBqabyL', 'hSVsbcCKU0', 'uZHsOrEcwX', 'InssdjU29T'
Source: 1.0.Result.exe.466afd.1.raw.unpack, SeYd2MuV7CCa9rOcfCT.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'xT9G98DZxlWrjMy07sE', 'ilCYtWDNXCA10SPVN12', 'VcjOEKDeu2CxhAfSxiI', 'EjAor4DFywv8Zp90pSm', 'HJK0YwDQGvRoftKap0g', 'eO7OwFDIy7po0ujoLBC'
Source: 1.0.Result.exe.466afd.1.raw.unpack, be01wYScfko2Rk8q3l.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'dn5j9Z5OL2Sdoxb29eG', 'FRlCZa5P8FORWG1F2ZN', 'gUdP2T5hxHZPWEkrURQ', 'RkA4qu5kNVSvum35ntr', 'akWy6G56Hn7ZWTsqO38', 'B4KkjM51Irbrd5vNpLj'
Source: 1.0.Result.exe.466afd.1.raw.unpack, fQYTMjaBdYZKqrutVJF.cs High entropy of concatenated method names: 'qIWJzvgxRp', 'T267vnVu17', 'GPv7unbpQK', 'rgv7ayy6mO', 'WeG7Jv1TDL', 'tBy773e1lu', 'EcI7RIEpD1', 'dMb7GOFXeQ', 'SO07s2xyW4', 'rJM7m2vaeG'
Source: 1.0.Result.exe.466afd.1.raw.unpack, zsdR2DsFJ035Ao7P5Da.cs High entropy of concatenated method names: 'Irj2YoGG1ABcf', 'h9a1ME41RCgl8HVVYfN', 'w9E8Xm4jA2xDmlOvE8o', 'eXkUiG4M20HP6mTIWRS', 'JCoRhf4qMJTZkKdTLAp', 'BHN2vZ4UKuAcF1BfJGc', 'Tp2os64kf6rrydLnhY7', 'JHUGiF46E00wbsLgwg8', 'qLZsSd4n90c3EyMAsxa', 'Hb2fcY4v5oP98U9RdQY'
Source: 1.0.Result.exe.466afd.1.raw.unpack, h0e0dTuwSbBJCD0PUZO.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'DQELgMiRZP1h5rZafOp', 'UFraYLi04yLNuETIrmW', 'qmImQtiY651ubENiEVk', 'Ht24gciEkYlr9jHhDSQ', 'lSFp8RixSTjnUvcwFs2', 'xDM4r3igZCs9Gc648Dy'
Source: 1.0.Result.exe.466afd.1.raw.unpack, xMtRJJpXLsZYYflx4d.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'HXMVWw5oLo29rhMlhEP', 'T72DWs5dtAEkFfBqhDv', 'Hfh6lQ5zkaYClVOpwO7', 'TvSPO0AlCMRrgRJxEr6', 'vu6NR2ApNxZK6yhZ8gS', 'qhNHTAA56dVOmIiu5Ft'
Source: 1.0.Result.exe.466afd.1.raw.unpack, QF29v6a4Ju3gjTbU5wG.cs High entropy of concatenated method names: 'wD8GmT7dqr', 'B84GZlZS3q', 'JnJNLZqS16LV3XPAWhY', 'XvHUmGqaqZ70OAoHunB', 'HvonmZqIPCvVJhwmID7', 'DIhJSbq8jrnO37bjej8', 'jEEGx2MVTR', 'eskNQNUlAa71REKdOdH', 'y28MVNUptH9DKPR8Jns', 'lf2scoqdRiiTUKLJQ2R'
Source: 1.0.Result.exe.466afd.1.raw.unpack, gIKnYfuRbL7BNFAgQ76.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'wFpNyH24P2EcfcTYJrq', 'AVaY7I2Z7kQ0LbMKA1o', 'vA9duC2N6piicgI2lyq', 'jr6o1W2eFTQgH2CoKu6', 'xHeaEc2Fyypsl2BFXbB', 'nLIGZm2QYW8SCPO0QoK'
Source: 1.0.Result.exe.466afd.1.raw.unpack, rGms3uRZTegQ4MAAamE.cs High entropy of concatenated method names: 'O5rqO4VmHX', 'S8cqd8PcXa', 'crr9Haf8WPI0DRyfyJZ', 'nic3CnfSwnp3FfrWmbd', 'oL5wlYfaRayyGm5rXFy', 'Rr8VSZfJGTTGucnafSy', 'wQVF5nfovErb2ZvMImQ', 'ijMgGMfdeqDAVh4phq0', 'kCNuemfz1FPSgMD1biq', 'nkyoRE3l53IghdG1mTj'
Source: 1.0.Result.exe.466afd.1.raw.unpack, BHyiaOus0I7Q9OIpcCc.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'Bj3tWo2SNmKIKAJnNn1', 'IyFQch2aNjgAc4s9fAu', 'VaQB762JnrK1CX8AW2g', 'PhLsyA2ojscujBZxA7Q', 'B4FRUN2d4IR5PxbNIBO', 'dUY9C12znYtErIDY9od'
Source: 1.0.Result.exe.466afd.1.raw.unpack, k0l47gRlvEaTDhPwYss.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'oNmVE8h8Qa', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 1.0.Result.exe.466afd.1.raw.unpack, qu6W1eRigMsiCkrjasr.cs High entropy of concatenated method names: 'OKGqH0d9eV', 'YWfqgYLxIZ', 'mApq5yEa6e', 'eL3rBX3014LMLEb8D2Y', 'TX34XO3KJVkAEQL7Qn8', 'Rl87Ua3Rq28DMYKEc5R', 'zIFCD23YEAlQuKKK6pG', 'MPkKN23ECqPlRbwwkpk', 'd57GBS3xHcg6HDGDEEp', 'By76403gUW1tvaetekf'
Source: 1.0.Result.exe.466afd.1.raw.unpack, Fc9DOUJgPccVdqBHYLP.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'A5XTIxckOd', '_168', 'KRic0xLcWMWwBQS87mY', 'Y8ZZLMLViIlIV2fIPKd', 'katGwPLuGIjRjUgdB71', 'lOUscfLmAygk1tnat9L', 'Oo6Jq0LyaTgt1Cw8PPX'
Source: 1.0.Result.exe.466afd.1.raw.unpack, AgDQU5atSwIhrkALSBE.cs High entropy of concatenated method names: 'JYf7MRZgmU', 'dey7naUFYM', 'TLc7zZoqPi', 'LPIRvdHfWa', 'HrJRu1DEuM', 'T9IRa02eG6', 'fYbRJ7cH72', 'RpZR7iZO6l', 'wl0RR3wv5P', 'FGBYU3jSfo2LCfGa0iv'
Source: 1.0.Result.exe.466afd.1.raw.unpack, rfPsabav2UvM2QpUgbr.cs High entropy of concatenated method names: 'v3taV2MiJG', 'rPxakjVS7w', 'shQa9ncd9M', 'peWxFtPtu1Om1DsLytd', 'WSwGH5PG4Sdu3YBXxOV', 'S8PIfLPChnykyEWixiY', 'B8HDCgPf0NUlhEoowSw', 'MRhor3P3I8XGh9AURXq', 'yJAyLJPKyuvjP9dUV7S', 'gZtiVwPBwqBlp9umXHV'
Source: 1.0.Result.exe.466afd.1.raw.unpack, OG5ESOaaTs3F9FrbVPp.cs High entropy of concatenated method names: 'GSbaHySp91', 'xqnage9Rru', 'URRa5cCcTs', 'iXsaow74yF', 'BnvajrDeai', 'F8vaY6WRq9', 'OqtvqXhqDGqsePMjSpf', 'LgeMxMhUi1DfySlntWT', 'h2Nck4hjGUgtJv6hWKY', 'Ucp5YHhMUURK9VMFUbp'
Source: 1.0.Result.exe.466afd.1.raw.unpack, zeNdTUuiBECNmWNZRAb.cs High entropy of concatenated method names: 'RKHu3cRYZ1', 'yAaRD7X52e1lYeTMZT7', 'i4n6VkXAF3EGsWP9WU8', 'ThpmdJXlkV9v99DgKnU', 'n5kCUhXpgKlptUjxEw8', 'tEM3q2XwU702WvFkOdx', 'y05xi9XWIB36lkkM47P', 'XZWQ9vX2k8Zx6e9vVjJ', 'ekTuHoht6A', 'hgbGExXbcDQSpeqmh6a'
Source: 1.0.Result.exe.466afd.1.raw.unpack, lSKh7M7Yw7JMD8IphkJ.cs High entropy of concatenated method names: 'lDcwMDk6eT', 'rjkwQ9Ipeq', 'fvhwpLatKT', 'HVWwhVgQBm', 'FRXweL4xIp', 'MaHwfyMota', 'l78w4dc4ug', 'G2Ew0rsJYL', 'HOewAWMS8E', 'zRQwIO6Hwx'
Source: 1.0.Result.exe.466afd.1.raw.unpack, MAYJ2eU6oA2amU8rYv.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'PKlhvEwqKW06ibrpFUW', 'M63riWwU10OQGCBMB96', 'mpcrKPwnuTDwjX3fyHG', 'FivCh2wvcYs68Jn7nsd', 'EQYLQjw9qfH8pgD2lH0', 'jic24Zw7RwhYvePusnJ'
Source: 1.0.Result.exe.466afd.1.raw.unpack, qUfW8WkSB35WUnZFJH.cs High entropy of concatenated method names: 'GOuQpMLkO', 'C0tpGo4DQ', 'ntWhFmoOA', 'YBlXNjpKiyCATqcjnJm', 'Ge8liYpfw7QuAD1342n', 'SHdplkp35wghJlxIQBo', 'JA5AD4pR39KxqsHpURu', 'wyN2ADp07f7rr1kIXC1', 'UC37HYpYvdOKIKS9YBd', 'd0b7KkpE5fE4E126Lsm'
Source: 1.0.Result.exe.466afd.1.raw.unpack, TpGEhH7d8LWqFHfeSfF.cs High entropy of concatenated method names: 'endLX160hL', 'WXILQnb9sa', 'qdOLpncbuD', 'dNjLhZD3sk', 'm1uLeiUO88', 'o88oQqVCwCqoOMvBtWq', 'tWIrsBVfeZ10wWd55eB', 'eMWPHQVtqVmmCRl878F', 'w8QprQVGSCiydEayxdE', 'gWw1TCV3DqOY4oB8nCI'
Source: 1.0.Result.exe.466afd.1.raw.unpack, PLOBy3u6e1luTcIIEpD.cs High entropy of concatenated method names: 'YhbabK1Hyi', 'MDixgCP2ZOD6TRZhcq9', 'Im3SjEPiNwWnjJ6rwUE', 'w8sYeOPwqreCJEdTVIl', 'XeI5mYPWKhXq2wql7SC', 'CapQ5MPDyaqGHXRPdBi', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 1.0.Result.exe.466afd.1.raw.unpack, yplOpsGGuyVdpAnPxjB.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 1.0.Result.exe.466afd.1.raw.unpack, Wvy3HBuDaueiK0aNGAg.cs High entropy of concatenated method names: 'RBEaFO9vPJ', 'ObMaK2W76O', 'i1ChF4OPsXFuI4ce95X', 'M3JSWxOXe6nQtougj5W', 'iliuvoOOt4vhFjOBJuP', 'yuh2j3Oh9va38Pkk0qK', 'kAXKTqOkIsfUWa1W26m', 'x6utBAO61Ab8CeDxYRJ', 'YgqQInO1pDQX2c7XPrS', 'qbtsD6Oj12xmSwsKKxn'
Source: 1.0.Result.exe.466afd.1.raw.unpack, wMvJA3RTuye10p4ltvx.cs High entropy of concatenated method names: 'PP8qjYoArO', 'gntqYpsejB', 'BX3qPtXdWs', 'b6iq6tlBhB', 'pT6qlPWot9', 'T1jqMcsQLA', 'qlaILG3NB4XiUCwabvT', 'VrrUf534Z9TmLv7IcPR', 'aCTplM3Zehv8HYfBOhR', 'cAWrDD3eDZiPL5Is0y9'
Source: 1.0.Result.exe.466afd.1.raw.unpack, hAcWYnugAdD8NNEUSM9.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'GsTy9DO9qkRTqHU2ppc', 'GTtUhrO7ylh71Pmvi2I', 'rTlKk6OrHVRJO56dfy4', 'pKbC3aOLscZr3aOktxX', 'FLIEUkOHk3iuuTJMAxU', 'BYlJMtOcXlpQ8WA4W6Y'
Source: 1.0.Result.exe.466afd.1.raw.unpack, shQncduF9MH0lrnsZqc.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'f0U4QEin2DEelIaG1PO', 'TeaRv3ivoeq99ljPtDl', 'yHnScri9AlEYduRoZBG', 'GRoPjgi7GF2yThorceR', 'suLBv6irb4HoAmfgUHr', 'jBxGlViLJdmgMPx0Keg'
Source: 1.0.Result.exe.466afd.1.raw.unpack, tSt0FE76Wd0fFuqvEWB.cs High entropy of concatenated method names: 'hs42VsawFe', 'xYq29gx12X', 'ApP2yTd19T', 'LMN2wcYO5C', 'qZs22tmhJJ', 'Glx2rvLRAi', 'hNn2xk8pkr', 'oT428flInC', 'K7q2BhtFWr', 'f2d2bIxfc4'
Source: 1.0.Result.exe.466afd.1.raw.unpack, ycwsREJzIPIANDdraYC.cs High entropy of concatenated method names: 'AmUCSeDMGK', 'sPnCt0xXYw', 'PshC1ftqCU', 'yFuoPUHYHnfZaBLHLw1', 'vA8JxbHE9RP0XAtjA37', 'Nj2oq7HR7sJlSGdcEHS', 'fYx3NPH0Z0h47EjSw21', 'j1NXdmHxgMaOMnr59uG', 'hAHPRmHg7sqV0eoQ0nI', 'Ppg5QFH4LTp4A1bwtRm'
Source: 1.0.Result.exe.466afd.1.raw.unpack, bequvj7LEvf7jMw3QBR.cs High entropy of concatenated method names: 'ltYKptt8IC', 'w8LKhIb1jl', 'XcLKeS2q9o', 'B00KfQGIcj', 'MBRK4mSGSE', 'Ok1ZgHcdCKC5PNmZ5XZ', 'hiNkOBczdYgcwmM0WV2', 'EwnYrHcJJRe0OA5jrcI', 'jEl7swco4f4JT9Gsxh2', 'yhfj2OVl19aSIaLjuRL'
Source: 1.0.Result.exe.466afd.1.raw.unpack, ldAW7AJN0cNZ6d5ssVJ.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'SPPpQDrkuDmGEHkN50R', 'rJgIDDr6XF9MvOCrEpo', 'YHMGd3r1TK00SlWgs2N', 'bQ2pxvrjrgJhNqWKrMA'
Source: 1.0.Result.exe.466afd.1.raw.unpack, RZGjsEawC2btEZ8YS3Q.cs High entropy of concatenated method names: 'daNJ6NFEOG', 'Ri4bLU6APlpZdUBd04P', 'VIXdKa6wdXOM9dsiJQC', 'KlHeEw6pteTkvM87ivU', 'zviK7165NusbMJ4nexO', 'QcC46M6WVfItH5T4ntP', 'MFnd2062U3SgrIHdyd6', 'aFgylH6iTlP41yjshGa', 'XdLHNR6D34O0kSVinIh', 'MRLnNc6bhClZgpWq4VM'
Source: 1.0.Result.exe.466afd.1.raw.unpack, kcZoqPaOi0PIdHfWahr.cs High entropy of concatenated method names: 'C8J7ybfPsa', 'r2U7wvM2Qp', 'SgVU071HrUEe0mDYsto', 'YqB8kv1cD0ytp7n8986', 'bn9S0u1r0Sn7iTEDT07', 'sex0vd1LaTawHjOI8nP', 'k8k7Wh1VG94kZQ2kZ0A', 'JnBPP91uW7SNwAJZ80l', 'kHk3aY1mtllUWpqdTjY', 'apxYe31yQEURxJITQAt'
Source: 1.0.Result.exe.466afd.1.raw.unpack, VD3ACbunfNyIAieYGaE.cs High entropy of concatenated method names: 'IJJacU9S40', 'Gd2aE2bby0', 'HcTaqU85oL', 'bKeZIHPOkGWdvy7p9Wa', 'uU4ygmPbEe8KLU5arO2', 'XVgAFjPXSZhIZUZumPM', 'aUSZoxPPQu5bcZDgpBo', 'zVAmH4Ph48mqYkVj8b9', 'f0gXRtPk0cZEl1IuHIL', 'CQviBJP6dMfHSBFakYf'
Source: 1.0.Result.exe.466afd.1.raw.unpack, iL157tR9IJ4n9Z8HDyg.cs High entropy of concatenated method names: 'AY3qfNNhmn', 'eJxq4k1131', 'FDmq0TZt90', 'ijOqAduAGY', 'DZTqIjbJgs', 'lwgEXR3mj0hDAiNAqs7', 'q6KgDY3V8y1GG6Py9lg', 'G8BYtQ3u0btXZvVn6HB', 'I7ZC5b3ydAhUxxkJsOD', 'dXGV6b3sQbckxmObsam'
Source: 1.0.Result.exe.466afd.1.raw.unpack, oWkbW3uJrCVSqE37LEN.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'eTLP8B2sFfFvO1hBNeI', 'SEWERE2BF1VTyqJQNVn', 'FHLDWR2Tdn3hhtHLi1Y', 'LuEL1T2tkbulN9kE9xb', 'HCsTKE2GMFFxat01Pil', 'xKdH2i2CC4PsASvyHJY'
Source: 1.0.Result.exe.466afd.1.raw.unpack, r4fcx1J8sA9v5jvJq3s.cs High entropy of concatenated method names: 'FIwmjmyJic', 't5FmYqvXKN', 'uUNmPCLenx', 'cqim6Uuequ', 'ajEmlvf7jM', 'njkfbt72N9EQXwb6dKA', 'VItXwq7inawyV9cKDVe', 'FICwVx7wXrguw9BjYk7', 'YkfNJ17WPQX9MNTrvwU', 'co60uf7DVT75OwFd0CW'
Source: 1.0.Result.exe.466afd.1.raw.unpack, g357BcsySpWm2aqpGZs.cs High entropy of concatenated method names: 'gHycqZ4VGXl3vO9j8ae', 'RlhEwa4uQLDKAuqFVka', 'LiuglG4HRlGt5kj6Yct', 'PoraGS4cn8F6lilr8Dh', 'gUcWwWfH1v', 'yjXy2y4st5CKiRBYOS9', 'Wh2vCT4BdgKTOJgpVce', 'T6kOcD4T8owPSo8MASG', 'M7bMvi4tZdklVH81bMh', 'LAmlpv4GgQsoF0t1lEZ'
Source: 1.0.Result.exe.466afd.1.raw.unpack, isPSxKzBHroYjkmh9f.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'B4ity72AarUHCPZKYgL', 'bt2gwJ2wXG7SHcy2agW', 'hrP09p2W49JJ7uZyW6N', 'c0Aqai22XGQo5tbwEdG', 'gOSqMe2iDPOtWXujZoU', 'rDtsuW2DRWh2cIAVduZ'
Source: 1.0.Result.exe.466afd.1.raw.unpack, pfo4q4aQk5FuH1OX904.cs High entropy of concatenated method names: 'ixfR1o4q4k', 'RFWtggMo8Z4rPZkrGUA', 'QhpN4CMd337I9Z7HUJH', 'seC42VMaASkscefaLN1', 'u49ltWMJ44EGDronl5K', 'ONaxG7MzAeKj9It4js8', 'wbn9y2qlIalQ4yMBnsZ', 'RQfsf4qpIhnnxjwvV0w', 'rbrLCGq5qSWsNyIftG1', 'V76KMdqAH8KohplaxcH'
Source: 1.0.Result.exe.466afd.1.raw.unpack, RO8oBiu9FUMJCr75hww.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'eA1rXvDdn2rkVGABqjg', 'ybhvB3DzlInaZSMRwca', 'APiVpybl9yor6D3xRjE', 'Fjpyv7bpjKEsPBvEjBv', 'bPhq4ib5Rtp06QRQH4G', 'bUiQeUbA3uKgWkpZBmD'
Source: 1.0.Result.exe.466afd.1.raw.unpack, J3GmXcsVgB8xj2jgOy1.cs High entropy of concatenated method names: 'aAXWq8nDhs', 'zK3WVUg6Gk', 'R9UWkiyXhJ', 'p0BW9uM3mh', 'TIIWSZYYRM', 'paIWtgFZdq', 'zueW1rCm7g', 'kq4WiEnGgH', 'TZKWWY5Hdq', 'kaQWTl6ne3'
Source: 1.0.Result.exe.466afd.1.raw.unpack, NeDMGK7MbPn0xXYwDsh.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 1.0.Result.exe.466afd.1.raw.unpack, zvPoZsuLyut2friVVKx.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'eG6nLUiuxUKnV5eLyXi', 'pUJZ1PimjKH6gsvY63v', 'zjOkeJiyvbqcNnbFZqd', 'qaoBcXisKJSL2cc2ZXP', 'HPxaTGiBQLTYlkyhoMW', 'n1Z4yCiTsrZ8jEutMOd'
Source: 1.0.Result.exe.466afd.1.raw.unpack, lUg6IVuNPD8o5vWXyvq.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'xmpuSHDHtONu3DY7gI5', 'f0DCvDDcOrmE0YuSXqj', 'EWe5ygDVqMDrknMPwW2', 'yOd3agDuEHM5GrTE2em', 'tKfajGDmEYqYmk3Ma2t', 'kwU5f5DyNawbeRABWSo'
Source: 1.0.Result.exe.466afd.1.raw.unpack, y6B2sEu8BO50D0gpddW.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'OeJ3AiDlFOeTZE9sPLU', 'BYlUfIDpJ0Zx9U2UUF2', 'oCJNCsD57IThYmAHZ8e', 'sT4aVdDA811tE9PcOat', 'GlrImTDwSlwWhcTmSAR', 'QbcgfrDWrMMZvuFM5I5'
Source: 1.0.Result.exe.466afd.1.raw.unpack, ECGWeuJ6XU2xwjttGYt.cs High entropy of concatenated method names: 'dK9IoRH30gleVrH40CO', 'XvqFU6HKSFUCkW5DiUU', 'O3oU8MHCdNyvewbRsv3', 'oRm8v9HfUVTMRiR0akc', 'IWF', 'j72', 'F4ECxC3aYt', 'l5AC83tX1e', 'j4z', 'JADCBWNQkt'
Source: 1.0.Result.exe.466afd.1.raw.unpack, fCvAaGJbOISiMM9DuTO.cs High entropy of concatenated method names: 'SbeZ2IyDjp', 'fEhZrH8LWq', 'jHfZxeSfF0', 'dtU9Nw7x10FSqWluxA6', 'uvkdFt7YbRCSR9eoGHL', 'Mm0VKs7EpTpfMZaMUcr', 'wt0onG7ghd1YfXogUOf', 'eP9ZGBBYXL', 'tuqZshxXjT', 'XfbZmATHvV'
Source: 1.0.Result.exe.466afd.1.raw.unpack, fD5S5GaeHF8smwvouSD.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'gSVRQSJ8O5', 'syWRp5GD5S', 'RGHRhF8smw', 'aouReSDFpS', 'xoGRf9UAwJ', 'R90KP9qbBddXc9Whdf9', 'bUdNn8qXrlWpkCaf2Oj', 'CFhsfAqiL9e2aM9bRsX'
Source: 1.0.Result.exe.466afd.1.raw.unpack, VDWJntWWlw06vjKFE9.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'UKF4W4Ftj', 'FtRNb25niECe3TqxKBF', 'Haw5205vt4HG2oMmh1J', 'w0iwxr59JfXiCHXXckh', 'CLZh3M57j2VYIXhdV6P', 'I1tL9G5rKYZZjOR5TRd'
Source: 1.0.Result.exe.466afd.1.raw.unpack, QECQLMRJjJZmG5cxf27.cs High entropy of concatenated method names: 'fk9F0KtrL0YK8Pvtsle', 'r5Ub1vtL4B55HmSjDMf', 'uEc4hAt9PcIsBR4khIt', 'TnP6BLt7OF4u1rZRYj0', 'lwhOqtffOA', 'eb49OdtV1hCpJNvaFcg', 'tWEpNltuJAG6Nv5Qyo6', 'bsSIF9tHAPhHXfTeOQu', 'q47p9ctcnrhvSJ9TQHn', 'gkxuj6tmQkcP6mg0Qhy'
Source: 1.0.Result.exe.466afd.1.raw.unpack, k9bi73G9mowv1Yj05Z4.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 1.0.Result.exe.466afd.1.raw.unpack, J5j6tMur4opWnoEyDT1.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'IPfpariIU4UxmBe88H8', 'dqEwYIi8LVaEAnky12k', 'minJ2TiS4ZlMrpVDkU2', 'wXqoecia0Ip93eaosPk', 'wgdo4YiJFQWgEY5AZPM', 'sNnD1Fio1uSsy6VCZWV'
Source: 1.0.Result.exe.466afd.1.raw.unpack, Sm7FCVRPUjdKT87y6Up.cs High entropy of concatenated method names: 'uknV7FveCA', 'WFMVRkpmJ0', 'aUYVGRi5bn', 'xb3Vsr1JtK', 'gHCVmj7fS7', 'aDqVZ9oSaf', 'OCpVCQxuwD', 'cyeVFU2RLd', 'HY4VKautly', 'CkbVLUnWBR'
Source: 1.0.Result.exe.466afd.1.raw.unpack, xODuXeu0FIatQXDBxY7.cs High entropy of concatenated method names: 'lvMaucu3Am', 'KSsaa4s9Pp', 'bsaaJRRIWx', 'b8RUhRXQ6kEHvPUxLiJ', 'Uu89pZXIh0GHuZkWmhO', 'vWpbI3XeBI4hJaPtsjx', 'sCCVLpXFHpsMyYmNdAo', 'pva2NcX8PT7YKYP75ZS', 'DlQYEpXS6QyrSOvW5Lo', 'jkEnI8XacSVkZvssR5k'
Source: 1.0.Result.exe.466afd.1.raw.unpack, em50CEGU2PgNRVJruTE.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'Rsu1Z4V8dD', 'ySG1CWKfXh', 'oyy1FYZ7Mj', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 1.0.Result.exe.466afd.1.raw.unpack, yHjnyrXIDUbermwuYI.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'GkuI6GEEd', 'w2qLZ15C7K5xAnc22GK', 'x6A02O5fZPRkUKNElhA', 'zP0qF353HX0BQX1a2ZT', 'nIAs3X5KE8vC8bmPN2N', 'sAwNRe5RWAXEkv4EEDJ'
Source: 1.0.Result.exe.466afd.1.raw.unpack, gHURQlJ7aCCH0lBIKXn.cs High entropy of concatenated method names: 'nfEsAgtGXi', 'O8VsI83LSF', 'tU5sUYGORO', 'bTus3tMYam', 'FrWsDX94ms', 'qpQsHcgXTb', 'B5S3o0nydvo8835xMDr', 'WwnjMknuNE4YeHRhIFH', 'uUWvTMnm8C8e5MaXcKM', 'nvTQqFnsD6DC7Ij5wQM'
Source: 1.0.Result.exe.466afd.1.raw.unpack, ofJ1RPRQqGuLNDpEiI3.cs High entropy of concatenated method names: 'XxmVvywmnm', 'Clx0IZ3J20QWK2TgKdZ', 'H5t7813SjErX15N3BCY', 'lY2kt63aVtGL6TKNlIa', 'pCs1d73oGGfUoVyNcXu', 'ro7Dii3dInbH4Ko8600', 'ovX94v3zY7rCg38iqWq'
Source: 1.0.Result.exe.466afd.1.raw.unpack, COd7l9Jrce6yBgJOwFE.cs High entropy of concatenated method names: 'EZLmg3AHwt', 'cbOm5I1qGr', 'jjAmoNcjaT', 'ktLL0C94c4msr6h72ft', 'z4eXEH9ZmwnZhPAixp0', 'qk2ETj9NSc0XqnnpEJF', 'VHfUke9eKIAGNuhqDd1', 'Fcn73O9FBdkrVZbKNQ3', 'PG9nOr9QpC3wvgrimum', 'LqCEht9IWX09cRDiIdf'
Source: 1.0.Result.exe.466afd.1.raw.unpack, uNFEOGuoEdjm4vpiMLI.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'UjsC4NOT4XXCBssLN93', 'sldjkEOt6Q5SUQPj0TL', 'cMJykHOGHFEw8FUJLqE', 'pc0ZJWOCGyQHIrOo05l', 'JmgRuPOfvjlwpM7FrOM', 'P7a5GqO3eo7EeRrhYiM'
Source: 1.0.Result.exe.466afd.1.raw.unpack, ToLjk3gvWXZNAAPPEs.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'rmAWQyW2oIrQjCaiDiE', 'qwhO4UWiFFlZq26SNtQ', 'Pm10aKWDU3pAduiLEN8', 'oAYmffWbI2eiCXcAhg5', 'J2AENtWXdqJK1dZHNd0', 'fKjKPKWOmSW5BohAFBM'
Source: 1.0.Result.exe.466afd.1.raw.unpack, SE9XYP6ZrMTs98IqVA.cs High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'f1U7RqWggDYThuUAEMl', 'KU8C5RW4fbspPQ5WHlb', 'caag74WZM4W1a3vcDa1', 'NEfO60WNSwMdA9VYEsY', 'lmQeoIWe10uuw4WYO2Q', 'ocOOQPWF1DpJt15M68I'
Source: 1.0.Result.exe.466afd.1.raw.unpack, tMovr3GV7CohDM44Ho9.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 1.0.Result.exe.466afd.1.raw.unpack, Qaas3LcbKU1PXAy0Tg.cs High entropy of concatenated method names: 'nBSqVpFEX', 'qayV2nntS', 'Rb5kkk4OD', 'Jfu9xkHS5', 'mnQSeY7Eu', 'CLGtYK0wq', 'FIt1g6BXB', 'wooyggpDGhfhPRGFFkS', 'NDw7fPpbjMe6FThWwLD', 'PwpWRupXFG8PHehhJhe'
Source: 1.0.Result.exe.466afd.1.raw.unpack, hCsNyXJD5vKLl0WFlhC.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'lZ8T0s0OrX', 'TNCC7kYobG', 'RQmTC8heMW', 'YJYnkyLkR8JSRoAdO4W', 'HkH37AL6CwPcWAw6myF', 'if3eydL1Qd3QF2BGkBU', 'LQZlNqLj1TyrmWpJQQT', 'KotKdILMgTkTvcnLxuP'
Source: 1.0.Result.exe.466afd.1.raw.unpack, p4VMiu79MPUyk8DkE6i.cs High entropy of concatenated method names: 'JeMyXos1Mo', 'SdLyQPn7LQ', 'ybcyplpcur', 'xg3yh4a4jx', 'jBAyelkSal', 'p1oRIsunLidrkxQK4lU', 'tqgvr8uqijJEd8w7OMC', 'BhuM0PuU0kdmyxuA67K', 'HPuWJ2uvKlQgjmZ1RIm', 'ixw6K5u9fUIJHcUSbCg'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, J9jqRkoToht6Axav6f.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'NeRaBUW1ToiQmqY3Rwp', 'cxiZinWj72nVAdcXFtW', 'T56YhrWMh1osaNqOjHR', 'BDYUL8WqNK0k69O2F5E', 'RNK64NWUJi0mjGC8VyL', 'OP10UKWnaks2Z2AOno0'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, TlC0uIJA6jdOfUly0tI.cs High entropy of concatenated method names: 'sg9', 'wWeT2aUocN', 'gduZMimUvT', 'NsbTJxswQ9', 'As1xPKrNyMaueOxExPs', 'pWD3APreyNI2m78JVuI', 'shknFTrFElF90iBIH8P', 'aRjImNr4RCOIkcgPCHw', 'O4xtRKrZ94mH3hVpF8j', 'hA8HtDrQvG9hgiwankP'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, W4xCsmJwFAc4CDRMHoT.cs High entropy of concatenated method names: 'KsvmIppiaB', 'Yo0mUc4SBs', 'jH0m3y6rGI', 'OTnmDvIaAB', 'jrnAKc9G447b270KKiT', 'vJ3mXx9C1n90Bua2BQt', 'Ue3DHg9fQhxijGYHUlH', 'iARrC49TL2yxMF6kqyM', 'CxuSBE9t4J44ncF6Uib', 'pnuppE93T9yhSy8suha'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, xWhDIfGh8PApjqkB3ox.cs High entropy of concatenated method names: 'Ik2tedcZ04', 'Om3ApNxsKqbW3n51uul', 'zdQZgoxBJFAGuUsfbH8', 'NG2iqBxmykD2tUFp9QB', 'avWtdSxyyegeVgngFdY', '_1fi', 'vX7SoIoDFB', '_676', 'IG9', 'mdP'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, z2U5t67BwbnoCjPv4Xh.cs High entropy of concatenated method names: '_7zt', 'ul0Lbsx9jl', 'uBWLOCSa2v', 'wvvLdoHtGD', 'tCDLNJT1D0', 'ljELcmUEcg', 'pmdLEcOYDb', 'y7k8cLVrPEIuYX3PGjU', 'sdWW35VLZ4kEC7IsFUC', 'la9BpTV93MMxWANCjIr'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, LNcjaT7FXIwmyJicO5F.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, x1G6pPDFtsh863ctT4.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'yqpQNVwx5g8fPmLxMCe', 'RhEWc7wgLklpOhO4MWA', 'qPaFTnw4Pa51WPWJeNe', 'qPVxQowZALaoCFqIoGH', 'R7kOyAwNFpCL1y1lM6L', 'n2PpPYweQZBQ1uhDVeB'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, YbgphxG5g9Jw5XMqvfv.cs High entropy of concatenated method names: 'Ieg1cRKl0u', '_1kO', '_9v4', '_294', 'B3E1EoZqlq', 'euj', 'WoR1qHBuiF', 'Ly31VcWfEE', 'o87', 'BMo1kEXC9F'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, LA0jeR7ctquxODXu7MJ.cs High entropy of concatenated method names: 'xeQ7kMVgaWIN9T1cJBo', 'fRvpU0V4ivCGHqAqpL9', 'iuwbFgVZEK2aHwLGsGf', 'meCvnIVEB3HujW43LW7', 'cCZZuYVxrMQSjtJSank'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, zsa8dOGEncbuD7NjZD3.cs High entropy of concatenated method names: 'IGD', 'CV5', 'fU7kqHZXS8', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, vfjP2WstDoN9mO43WJ.cs High entropy of concatenated method names: 'TP2yWtDoN', 'IkxFySth9nD3whLt97', 'PBl4e1BjKXOigQKa02', 'CS0eFKTlJVOsvec85V', 'Uq6nQlG74RHq6By2xe', 'IQuS2JCnJ7NsHFCat7', 'usSaTkVf2', 'QblJnL1ll', 'NWk769qq6', 'Xp4RZ0tii'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, KtgOgEaZxpZ7Xqg6q3Q.cs High entropy of concatenated method names: 'Bx1JTvsBI3', 'axWJXM5GUp', 'HqOJQDuXeF', 'NatJpQXDBx', 'U7fJhZuoVp', 'j1FJeTfc2c', 'tHLJfWMGkX', 'rCnSXJkHRmil7MaF6wq', 'zDe4lOkryOOR7oWTUJh', 'PTXpl7kLDJsChlQml37'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, RtainsGW4fxAhFbG8mU.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'Jo19VKUunB', 'QpH9ke6yvx', 'ikD99iHbbt', 'd7Q9SGmiwK', 'StI9tbeh23', 'AGR91hbTCp', 'BtuFXpE3Sj6CGHhFk7A'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, mv5PHLacBSFYVLFlVtf.cs High entropy of concatenated method names: 'a8J7ddANZF', 'z5K7NLqrcy', 'HrT7c5HjGV', 'Ur67EVZIcl', 'Mqr7q6ry60', 'a09Zc1jlQ5Fkp1Jt3el', 'lrMuNTjptBcusK9YmRb', 'a19V3F1dDI181KJgMCW', 'nA0ijV1z9b9hdKZEkE0', 'j75MhLj56UkFDk6RXal'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, NrTABiMLvMcu3Am0Ss.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'dT129dW8EocRGopwult', 'ds5s1cWSaUEsRvsxJAP', 'X88anOWabYXJV5SBjK7', 'LtZ54PWJO2n0NfYEIVc', 'VAhsliWoaN0XlikE5dw', 'toJ22wWdYbwahnCG4EI'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, OTnvIa7ZABiAU1abijT.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, JUVOIm7RlYOijLikpvR.cs High entropy of concatenated method names: 'TteKxUdyOO', 'wZtunFcUkQJOoOFbOYk', 'Qq4QUXcnuMXKffT3Pq2', 'hQrsg7cMlG5o9pwAnJS', 'pDDTJmcqtZoQvqkdDFY', 'VlLCimatXa', 'ficCWjMZEv', 'abWCTCW0oa', 'KOnCX3ghAF', 'gNiCQbsCLB'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, J7G5cQGNO049YArLSx8.cs High entropy of concatenated method names: 'qkZkO5X4QS', 'cfokdOAgOt', 'AUnkN3lcV1', 'XHYkcasMv4', 't63kEQ6qTp', 'duxUXM0JtyRW44EHpj6', 'zkcGv50oXgjgonrWr4A', 'hIpwoC0dHeSqWb3IpLP', 'E9DurO0z2kngWE0GhYd', 'rMUvxZYlTUnbwSGXEju'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, lGIwbmGXEyGlkwZ4fNQ.cs High entropy of concatenated method names: 'aqdCpExwqlDruXWT4i3', 'eKr7uvxWiTm6lFgTDoQ', 'JcBmFfx5AZZhF9Ko9MP', 'BwQmvjxAYuUn8HKa1ON', 'MoK9QKmwKx', 'WM4', '_499', 'BOH9poeXOq', 'Iym9hiLCcv', 'RtJ9eKVVOO'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, iKm6ibax7bVYVLsjWVD.cs High entropy of concatenated method names: 'XLIJMD1G6D', 'IOIJnFdR0N', 'x2mFLS6ngyVfnx4wnmo', 'apgX0X6vKIJjsKhByhu', 'lOTYtt69eM0bw65xiUP', 'BRLpgR678bDO6RULWRK', 'MHYM5K6rAsdQOZY9ynr', 'KRQ0Jw6Ltb1Qs3kAX6r', 'B26FY96HbCfng2OA2lV', 'GuSCG66cW36wS9o8Wm9'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, s703IyRjy6OOtM6MNFo.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, p8kJJFJoqqCLtyZGyuA.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'rhvCFbsPN8', 'LRfTlF7s2H', 'oDrCKnMnTr', 'OKGTA7S6tn', 'JUVsSRLKMCdAoDZ2E8s', 'EyCMYfLR4EWgf5dnOB1', 'jvuEKULfnZ3jlps75ku'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, vLS2q9Rno100QGIcjAB.cs High entropy of concatenated method names: 'vpJVSYBDqc', 'RkKVtWD1xv', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'TAbV10ABwK', '_5f9', 'A6Y'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, kcYm2yAxiu8duiBOo3.cs High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'FR0EvjwOfJt4LTiakre', 'trY9aiwPykcg5DAFO82', 'aEdEWIwhuyrMDphvTFD', 'lFRhOrwkhvvttQcL7Yy', 'ztPYSUw6cZGNpjoRteG', 'cBtVTVw1OaVOiZGZk4C'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, MywuO0ecBIEDWkejmN.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'V2Ih4YAf3GPHWR9W79M', 'ljZu5fA3nWpx3iyxV8J', 'DMr8OVAKtOxE8KgVOD0', 'sHVIOhARgHOatl6Xv9h', 'EnpilrA0k7U6PHZqmoR', 'LylQ69AYdVrdeVf4J0C'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, rHt7uMJCfWa9UHePPBG.cs High entropy of concatenated method names: 'RSXmXJTWCT', 'zeFmQ34xTc', 'MyDmpVtx3v', 'r2gMmd96TEsbkAmpEtR', 'V3oX6i9hoRq5vFZsXjC', 'a45LGk9kmUhfG56fb54', 'hB3FLF912jKHsxyg6mD', 'Qnmm2DFJ85', 'dEAmrLVT13', 'McPmxMbPGD'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, WcHawNutdttSSVMdLiu.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'DtiAUybfglg1rI2lxEa', 'avXXLob3sThGvOOyXf4', 'C1m3xcbKqALkaHyr02u', 'jpwmGGbR9ECWEfRt32G', 'aKv6Y0b0Kilh7vaPRK4', 'IuTffrbYIPYwLOMscqB'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, BHb0VlGaagfBmK20jUO.cs High entropy of concatenated method names: 'mD7kmaKj58', 'NmjkZxMgLf', '_8r1', 'tiukCDPQXf', 'W1UkFOj7TG', 'RVqkKMqLTC', 'd8hkL9vqb7', 'Vc6FlX0jVgtAkSOeLJT', 'HgVEV20MX3Nxi60O2Bh', 'H1VpXo0qw8TKhVfW4rN'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, ef7UDCGv7gcEUFZT1op.cs High entropy of concatenated method names: 'EARV3OyIYC', 'IJ4VDKoCx0', 'cErVHCNGBZ', 'ryDVgQK08h', 'jKMV5L5PGV', 'QSjVoAYUOg', '_838', 'vVb', 'g24', '_9oL'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, J0Qd22uZbby0hcTU85o.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'Xidlv6iidhPmlAyN6mU', 'P1MOZ3iDaU5ef7Qi494', 'iyDh2sib7THfe0NTKKi', 'iieZ9TiXe0IshoiWiKl', 'Gu5whiiOm1tcQKZUTUD', 'EJZ8qAiPL34sircwnja'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, sy9nlb4UjJR8gEsPiC.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'SnrNErAa8fQm6iVuCUe', 'x3n3fyAJQOPS2UyJ1IQ', 'X5LNUIAoCJXTKSaAQPf', 'Fl15a5Ad56UhGBpceEY', 'N4X4CQAzFKbU1tSoY4E', 'zZxSjAwlfybt4YBjRqe'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, PCKnhaJqFcgQEqef9I7.cs High entropy of concatenated method names: 'eZxZTAVhBN', 'bgRZXOj5Lk', 'MLgB0orUAfjlrdID2Mf', 'ODSMvZrnbieKPa5hUl8', 'jGJLCXrMgRXEtqROiY8', 'Qgo283rq7Gcv69poj2C', 'HB7NCUrv7VYfosJupxK', 'MQxgV4r9t3tTeOMiUSb'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, ff8RppJuiGtFdXf28Cx.cs High entropy of concatenated method names: 'JMCs1VcsXA', 'MDgsiJs4mA', 'aDosW7ZouH', 'LwGsTlkUSf', 'Xn6m2PUzvQZLX401N9M', 'pPx5wAUoAimPpCO1kdd', 'avJg16UdShgaOOJWU3U', 'rYB7MPnl7cfsJHyUDjb', 'ooIaLvnp4NZOCJmUqeY', 'QrWe5gn5UFReTyqZnw8'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, W6hetLuEAbhKOOpdNis.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'buRvaHDC5cd0felcx4t', 'o8YwRSDf7jevKmnUEwc', 'FvsMmpD3QUVkA3xr8Ky', 'egw2GGDKy6Oj4vbPwuw', 'AIQv3MDRTgeeY3ZNs0p', 'vm94hdD0VJ3bic8oQUU'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, jgeZRtuuWoVL5c6k13I.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'xbtWNw2n63NZBbWOgis', 'hhFgC12vm7GucRlqyyH', 'YJsHUW29nc5NZKpNXYv', 'bNLUD027x1aE4iaY9V1', 'sjpANu2reLArjoGryl0', 'ARyCkh2LS1RjHRC33oQ'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, yeQlmn7qaACEmCIw5Xr.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'lGIyvwbmEy', '_3il', 'flkyuwZ4fN', 'Gkyyan4Bhe', '_78N', 'z3K'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, rkWbSxue3YUmlTIaIta.cs High entropy of concatenated method names: 'XTsuM98IqV', 'VQW7J7X3nhI2cAr652f', 'SALUVSXKecWK7N0HLJ4', 'thImEjXCX7Ffj9dfJTE', 'IcBLirXfbEXoL4ySiS5', 'vphbTyXRAnH5rDaffAd', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, fNCQZKGtx1VHEenG35h.cs High entropy of concatenated method names: 'rmP9Z5MjGy', 'FG19CsQjJU', 'M3J9FZWAgt', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'XXw9KXv23w'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, QqtijouQ8IvvqFJ7LPx.cs High entropy of concatenated method names: 'zqDuY7cqcN', 'nOhLjxXHBRMer6h1jM9', 'dG2oOJXcKWfXJj8yJoW', 'pRMZAUXroBKUMimmbXR', 'mluELyXL3uLZKoNBlJd', 'NBVK9aXVkrWWn09F27b', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, g5HUDyJUtfPsndj7DmN.cs High entropy of concatenated method names: '_5u9', 'GCUT5S27ul', 'slwCvbAhGb', 'xyGToDs18J', 'aIk0jhrJbsXMP929EpM', 'cOwcgIroEegYLaBH46t', 'vflGPerd6yffLg731Vh', 'D76O4NrSbeg0WJcChrG', 'qvTWxGragFZbF3yKLNK', 'RHS7ArrzcEbRisiabRq'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, Ye9RruubYRRcCcTsZXs.cs High entropy of concatenated method names: 'nyxu1iu8du', 'SmHkmyDqYHf11oxfhsN', 'pNP058DUCaVLqCccnDL', 'pH6n8MDj3TJdIFbk0XK', 'aQ6UQdDMMqng1fFcVcL', 'VwiSnZDnuJdNNN7YZYx', 'PXblMlDvQTUueTjmySd', 'mAj8BsD9S7S90jpwpuY', 'JDC3iBD73XBdPXO6LFs', 'f28'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, pvDVj975CFnUK40X4EC.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'eP5w2DasP1', 'RM5wrDnPV5', 'r8j', 'LS1', '_55S'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, JelU0LJLqUaCCMtuWxf.cs High entropy of concatenated method names: '_223', 'CtHC3E9qtlvnlt2iFpS', 'gPvN3u9UMJDR8N8jnn6', 'uoDScJ9nFsYYDb0ZGb7', 'XkiVS59vFrKDGHWhT1c', 'nvw3Fi99L0jExOV614b', 'YRusbv97vHCQrBCENNb', 'dKacc69rICMeHB7HKci', 'IXyA5Y9LyuYEyjkCrmj', 'Ek844t9Hjrf9fJxn5xN'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, V9BBYX7xLOuqhxXjTMf.cs High entropy of concatenated method names: 'J5NL70skTh', 'yunLRlgP9Z', 'sQOLGatoOC', 'm1XGY8VMf1eO59JjFtI', 'Jv22w7VqeMiqPH3oRgj', 'sHd4hNV1GaRmV073Cyk', 'NtrSHoVjHaqe2k1nD3N', 'iF2uPkVUs8cfpfoIuk9', 'v33IgYVnqGZj3o9mTbc', 'PQxlJRVvmFNPjC7xxqN'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, qjbesxY1j409qD7cqc.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'I65A8jWmRkI6ynCHL9V', 'bTOgHiWy2YYW3MPYtia', 'qPFyyRWsGKygSJTY35u', 'GsUYAiWBij1JbPSU0JP', 'pbrd6NWTDhXPRuU5aap', 'T6ToYwWtrB4KUifCH9e'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, iFEE2ManVTRtGTQFLd9.cs High entropy of concatenated method names: 'CXwsVGJsVf', 'NwZ56WUFooG1JYmHA9r', 'YVNlLnUNAZbZ5kZkmFp', 'D6FSKBUeYNvMUk9JdiX', 't9JXbqUQ7tY8iUp61Hm', 'Obi3wWUIM14I81IywGF', 'gRPsBqabyL', 'hSVsbcCKU0', 'uZHsOrEcwX', 'InssdjU29T'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, SeYd2MuV7CCa9rOcfCT.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'xT9G98DZxlWrjMy07sE', 'ilCYtWDNXCA10SPVN12', 'VcjOEKDeu2CxhAfSxiI', 'EjAor4DFywv8Zp90pSm', 'HJK0YwDQGvRoftKap0g', 'eO7OwFDIy7po0ujoLBC'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, be01wYScfko2Rk8q3l.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'dn5j9Z5OL2Sdoxb29eG', 'FRlCZa5P8FORWG1F2ZN', 'gUdP2T5hxHZPWEkrURQ', 'RkA4qu5kNVSvum35ntr', 'akWy6G56Hn7ZWTsqO38', 'B4KkjM51Irbrd5vNpLj'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, fQYTMjaBdYZKqrutVJF.cs High entropy of concatenated method names: 'qIWJzvgxRp', 'T267vnVu17', 'GPv7unbpQK', 'rgv7ayy6mO', 'WeG7Jv1TDL', 'tBy773e1lu', 'EcI7RIEpD1', 'dMb7GOFXeQ', 'SO07s2xyW4', 'rJM7m2vaeG'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, zsdR2DsFJ035Ao7P5Da.cs High entropy of concatenated method names: 'Irj2YoGG1ABcf', 'h9a1ME41RCgl8HVVYfN', 'w9E8Xm4jA2xDmlOvE8o', 'eXkUiG4M20HP6mTIWRS', 'JCoRhf4qMJTZkKdTLAp', 'BHN2vZ4UKuAcF1BfJGc', 'Tp2os64kf6rrydLnhY7', 'JHUGiF46E00wbsLgwg8', 'qLZsSd4n90c3EyMAsxa', 'Hb2fcY4v5oP98U9RdQY'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, h0e0dTuwSbBJCD0PUZO.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'DQELgMiRZP1h5rZafOp', 'UFraYLi04yLNuETIrmW', 'qmImQtiY651ubENiEVk', 'Ht24gciEkYlr9jHhDSQ', 'lSFp8RixSTjnUvcwFs2', 'xDM4r3igZCs9Gc648Dy'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, xMtRJJpXLsZYYflx4d.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'HXMVWw5oLo29rhMlhEP', 'T72DWs5dtAEkFfBqhDv', 'Hfh6lQ5zkaYClVOpwO7', 'TvSPO0AlCMRrgRJxEr6', 'vu6NR2ApNxZK6yhZ8gS', 'qhNHTAA56dVOmIiu5Ft'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, QF29v6a4Ju3gjTbU5wG.cs High entropy of concatenated method names: 'wD8GmT7dqr', 'B84GZlZS3q', 'JnJNLZqS16LV3XPAWhY', 'XvHUmGqaqZ70OAoHunB', 'HvonmZqIPCvVJhwmID7', 'DIhJSbq8jrnO37bjej8', 'jEEGx2MVTR', 'eskNQNUlAa71REKdOdH', 'y28MVNUptH9DKPR8Jns', 'lf2scoqdRiiTUKLJQ2R'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, gIKnYfuRbL7BNFAgQ76.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'wFpNyH24P2EcfcTYJrq', 'AVaY7I2Z7kQ0LbMKA1o', 'vA9duC2N6piicgI2lyq', 'jr6o1W2eFTQgH2CoKu6', 'xHeaEc2Fyypsl2BFXbB', 'nLIGZm2QYW8SCPO0QoK'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, rGms3uRZTegQ4MAAamE.cs High entropy of concatenated method names: 'O5rqO4VmHX', 'S8cqd8PcXa', 'crr9Haf8WPI0DRyfyJZ', 'nic3CnfSwnp3FfrWmbd', 'oL5wlYfaRayyGm5rXFy', 'Rr8VSZfJGTTGucnafSy', 'wQVF5nfovErb2ZvMImQ', 'ijMgGMfdeqDAVh4phq0', 'kCNuemfz1FPSgMD1biq', 'nkyoRE3l53IghdG1mTj'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, BHyiaOus0I7Q9OIpcCc.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'Bj3tWo2SNmKIKAJnNn1', 'IyFQch2aNjgAc4s9fAu', 'VaQB762JnrK1CX8AW2g', 'PhLsyA2ojscujBZxA7Q', 'B4FRUN2d4IR5PxbNIBO', 'dUY9C12znYtErIDY9od'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, k0l47gRlvEaTDhPwYss.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'oNmVE8h8Qa', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, qu6W1eRigMsiCkrjasr.cs High entropy of concatenated method names: 'OKGqH0d9eV', 'YWfqgYLxIZ', 'mApq5yEa6e', 'eL3rBX3014LMLEb8D2Y', 'TX34XO3KJVkAEQL7Qn8', 'Rl87Ua3Rq28DMYKEc5R', 'zIFCD23YEAlQuKKK6pG', 'MPkKN23ECqPlRbwwkpk', 'd57GBS3xHcg6HDGDEEp', 'By76403gUW1tvaetekf'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, Fc9DOUJgPccVdqBHYLP.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'A5XTIxckOd', '_168', 'KRic0xLcWMWwBQS87mY', 'Y8ZZLMLViIlIV2fIPKd', 'katGwPLuGIjRjUgdB71', 'lOUscfLmAygk1tnat9L', 'Oo6Jq0LyaTgt1Cw8PPX'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, AgDQU5atSwIhrkALSBE.cs High entropy of concatenated method names: 'JYf7MRZgmU', 'dey7naUFYM', 'TLc7zZoqPi', 'LPIRvdHfWa', 'HrJRu1DEuM', 'T9IRa02eG6', 'fYbRJ7cH72', 'RpZR7iZO6l', 'wl0RR3wv5P', 'FGBYU3jSfo2LCfGa0iv'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, rfPsabav2UvM2QpUgbr.cs High entropy of concatenated method names: 'v3taV2MiJG', 'rPxakjVS7w', 'shQa9ncd9M', 'peWxFtPtu1Om1DsLytd', 'WSwGH5PG4Sdu3YBXxOV', 'S8PIfLPChnykyEWixiY', 'B8HDCgPf0NUlhEoowSw', 'MRhor3P3I8XGh9AURXq', 'yJAyLJPKyuvjP9dUV7S', 'gZtiVwPBwqBlp9umXHV'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, OG5ESOaaTs3F9FrbVPp.cs High entropy of concatenated method names: 'GSbaHySp91', 'xqnage9Rru', 'URRa5cCcTs', 'iXsaow74yF', 'BnvajrDeai', 'F8vaY6WRq9', 'OqtvqXhqDGqsePMjSpf', 'LgeMxMhUi1DfySlntWT', 'h2Nck4hjGUgtJv6hWKY', 'Ucp5YHhMUURK9VMFUbp'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, zeNdTUuiBECNmWNZRAb.cs High entropy of concatenated method names: 'RKHu3cRYZ1', 'yAaRD7X52e1lYeTMZT7', 'i4n6VkXAF3EGsWP9WU8', 'ThpmdJXlkV9v99DgKnU', 'n5kCUhXpgKlptUjxEw8', 'tEM3q2XwU702WvFkOdx', 'y05xi9XWIB36lkkM47P', 'XZWQ9vX2k8Zx6e9vVjJ', 'ekTuHoht6A', 'hgbGExXbcDQSpeqmh6a'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, lSKh7M7Yw7JMD8IphkJ.cs High entropy of concatenated method names: 'lDcwMDk6eT', 'rjkwQ9Ipeq', 'fvhwpLatKT', 'HVWwhVgQBm', 'FRXweL4xIp', 'MaHwfyMota', 'l78w4dc4ug', 'G2Ew0rsJYL', 'HOewAWMS8E', 'zRQwIO6Hwx'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, MAYJ2eU6oA2amU8rYv.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'PKlhvEwqKW06ibrpFUW', 'M63riWwU10OQGCBMB96', 'mpcrKPwnuTDwjX3fyHG', 'FivCh2wvcYs68Jn7nsd', 'EQYLQjw9qfH8pgD2lH0', 'jic24Zw7RwhYvePusnJ'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, qUfW8WkSB35WUnZFJH.cs High entropy of concatenated method names: 'GOuQpMLkO', 'C0tpGo4DQ', 'ntWhFmoOA', 'YBlXNjpKiyCATqcjnJm', 'Ge8liYpfw7QuAD1342n', 'SHdplkp35wghJlxIQBo', 'JA5AD4pR39KxqsHpURu', 'wyN2ADp07f7rr1kIXC1', 'UC37HYpYvdOKIKS9YBd', 'd0b7KkpE5fE4E126Lsm'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, TpGEhH7d8LWqFHfeSfF.cs High entropy of concatenated method names: 'endLX160hL', 'WXILQnb9sa', 'qdOLpncbuD', 'dNjLhZD3sk', 'm1uLeiUO88', 'o88oQqVCwCqoOMvBtWq', 'tWIrsBVfeZ10wWd55eB', 'eMWPHQVtqVmmCRl878F', 'w8QprQVGSCiydEayxdE', 'gWw1TCV3DqOY4oB8nCI'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, PLOBy3u6e1luTcIIEpD.cs High entropy of concatenated method names: 'YhbabK1Hyi', 'MDixgCP2ZOD6TRZhcq9', 'Im3SjEPiNwWnjJ6rwUE', 'w8sYeOPwqreCJEdTVIl', 'XeI5mYPWKhXq2wql7SC', 'CapQ5MPDyaqGHXRPdBi', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, yplOpsGGuyVdpAnPxjB.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, Wvy3HBuDaueiK0aNGAg.cs High entropy of concatenated method names: 'RBEaFO9vPJ', 'ObMaK2W76O', 'i1ChF4OPsXFuI4ce95X', 'M3JSWxOXe6nQtougj5W', 'iliuvoOOt4vhFjOBJuP', 'yuh2j3Oh9va38Pkk0qK', 'kAXKTqOkIsfUWa1W26m', 'x6utBAO61Ab8CeDxYRJ', 'YgqQInO1pDQX2c7XPrS', 'qbtsD6Oj12xmSwsKKxn'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, wMvJA3RTuye10p4ltvx.cs High entropy of concatenated method names: 'PP8qjYoArO', 'gntqYpsejB', 'BX3qPtXdWs', 'b6iq6tlBhB', 'pT6qlPWot9', 'T1jqMcsQLA', 'qlaILG3NB4XiUCwabvT', 'VrrUf534Z9TmLv7IcPR', 'aCTplM3Zehv8HYfBOhR', 'cAWrDD3eDZiPL5Is0y9'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, hAcWYnugAdD8NNEUSM9.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'GsTy9DO9qkRTqHU2ppc', 'GTtUhrO7ylh71Pmvi2I', 'rTlKk6OrHVRJO56dfy4', 'pKbC3aOLscZr3aOktxX', 'FLIEUkOHk3iuuTJMAxU', 'BYlJMtOcXlpQ8WA4W6Y'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, shQncduF9MH0lrnsZqc.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'f0U4QEin2DEelIaG1PO', 'TeaRv3ivoeq99ljPtDl', 'yHnScri9AlEYduRoZBG', 'GRoPjgi7GF2yThorceR', 'suLBv6irb4HoAmfgUHr', 'jBxGlViLJdmgMPx0Keg'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, tSt0FE76Wd0fFuqvEWB.cs High entropy of concatenated method names: 'hs42VsawFe', 'xYq29gx12X', 'ApP2yTd19T', 'LMN2wcYO5C', 'qZs22tmhJJ', 'Glx2rvLRAi', 'hNn2xk8pkr', 'oT428flInC', 'K7q2BhtFWr', 'f2d2bIxfc4'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, ycwsREJzIPIANDdraYC.cs High entropy of concatenated method names: 'AmUCSeDMGK', 'sPnCt0xXYw', 'PshC1ftqCU', 'yFuoPUHYHnfZaBLHLw1', 'vA8JxbHE9RP0XAtjA37', 'Nj2oq7HR7sJlSGdcEHS', 'fYx3NPH0Z0h47EjSw21', 'j1NXdmHxgMaOMnr59uG', 'hAHPRmHg7sqV0eoQ0nI', 'Ppg5QFH4LTp4A1bwtRm'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, bequvj7LEvf7jMw3QBR.cs High entropy of concatenated method names: 'ltYKptt8IC', 'w8LKhIb1jl', 'XcLKeS2q9o', 'B00KfQGIcj', 'MBRK4mSGSE', 'Ok1ZgHcdCKC5PNmZ5XZ', 'hiNkOBczdYgcwmM0WV2', 'EwnYrHcJJRe0OA5jrcI', 'jEl7swco4f4JT9Gsxh2', 'yhfj2OVl19aSIaLjuRL'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, ldAW7AJN0cNZ6d5ssVJ.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'SPPpQDrkuDmGEHkN50R', 'rJgIDDr6XF9MvOCrEpo', 'YHMGd3r1TK00SlWgs2N', 'bQ2pxvrjrgJhNqWKrMA'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, RZGjsEawC2btEZ8YS3Q.cs High entropy of concatenated method names: 'daNJ6NFEOG', 'Ri4bLU6APlpZdUBd04P', 'VIXdKa6wdXOM9dsiJQC', 'KlHeEw6pteTkvM87ivU', 'zviK7165NusbMJ4nexO', 'QcC46M6WVfItH5T4ntP', 'MFnd2062U3SgrIHdyd6', 'aFgylH6iTlP41yjshGa', 'XdLHNR6D34O0kSVinIh', 'MRLnNc6bhClZgpWq4VM'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, kcZoqPaOi0PIdHfWahr.cs High entropy of concatenated method names: 'C8J7ybfPsa', 'r2U7wvM2Qp', 'SgVU071HrUEe0mDYsto', 'YqB8kv1cD0ytp7n8986', 'bn9S0u1r0Sn7iTEDT07', 'sex0vd1LaTawHjOI8nP', 'k8k7Wh1VG94kZQ2kZ0A', 'JnBPP91uW7SNwAJZ80l', 'kHk3aY1mtllUWpqdTjY', 'apxYe31yQEURxJITQAt'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, VD3ACbunfNyIAieYGaE.cs High entropy of concatenated method names: 'IJJacU9S40', 'Gd2aE2bby0', 'HcTaqU85oL', 'bKeZIHPOkGWdvy7p9Wa', 'uU4ygmPbEe8KLU5arO2', 'XVgAFjPXSZhIZUZumPM', 'aUSZoxPPQu5bcZDgpBo', 'zVAmH4Ph48mqYkVj8b9', 'f0gXRtPk0cZEl1IuHIL', 'CQviBJP6dMfHSBFakYf'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, iL157tR9IJ4n9Z8HDyg.cs High entropy of concatenated method names: 'AY3qfNNhmn', 'eJxq4k1131', 'FDmq0TZt90', 'ijOqAduAGY', 'DZTqIjbJgs', 'lwgEXR3mj0hDAiNAqs7', 'q6KgDY3V8y1GG6Py9lg', 'G8BYtQ3u0btXZvVn6HB', 'I7ZC5b3ydAhUxxkJsOD', 'dXGV6b3sQbckxmObsam'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, oWkbW3uJrCVSqE37LEN.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'eTLP8B2sFfFvO1hBNeI', 'SEWERE2BF1VTyqJQNVn', 'FHLDWR2Tdn3hhtHLi1Y', 'LuEL1T2tkbulN9kE9xb', 'HCsTKE2GMFFxat01Pil', 'xKdH2i2CC4PsASvyHJY'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, r4fcx1J8sA9v5jvJq3s.cs High entropy of concatenated method names: 'FIwmjmyJic', 't5FmYqvXKN', 'uUNmPCLenx', 'cqim6Uuequ', 'ajEmlvf7jM', 'njkfbt72N9EQXwb6dKA', 'VItXwq7inawyV9cKDVe', 'FICwVx7wXrguw9BjYk7', 'YkfNJ17WPQX9MNTrvwU', 'co60uf7DVT75OwFd0CW'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, g357BcsySpWm2aqpGZs.cs High entropy of concatenated method names: 'gHycqZ4VGXl3vO9j8ae', 'RlhEwa4uQLDKAuqFVka', 'LiuglG4HRlGt5kj6Yct', 'PoraGS4cn8F6lilr8Dh', 'gUcWwWfH1v', 'yjXy2y4st5CKiRBYOS9', 'Wh2vCT4BdgKTOJgpVce', 'T6kOcD4T8owPSo8MASG', 'M7bMvi4tZdklVH81bMh', 'LAmlpv4GgQsoF0t1lEZ'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, isPSxKzBHroYjkmh9f.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'B4ity72AarUHCPZKYgL', 'bt2gwJ2wXG7SHcy2agW', 'hrP09p2W49JJ7uZyW6N', 'c0Aqai22XGQo5tbwEdG', 'gOSqMe2iDPOtWXujZoU', 'rDtsuW2DRWh2cIAVduZ'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, pfo4q4aQk5FuH1OX904.cs High entropy of concatenated method names: 'ixfR1o4q4k', 'RFWtggMo8Z4rPZkrGUA', 'QhpN4CMd337I9Z7HUJH', 'seC42VMaASkscefaLN1', 'u49ltWMJ44EGDronl5K', 'ONaxG7MzAeKj9It4js8', 'wbn9y2qlIalQ4yMBnsZ', 'RQfsf4qpIhnnxjwvV0w', 'rbrLCGq5qSWsNyIftG1', 'V76KMdqAH8KohplaxcH'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, RO8oBiu9FUMJCr75hww.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'eA1rXvDdn2rkVGABqjg', 'ybhvB3DzlInaZSMRwca', 'APiVpybl9yor6D3xRjE', 'Fjpyv7bpjKEsPBvEjBv', 'bPhq4ib5Rtp06QRQH4G', 'bUiQeUbA3uKgWkpZBmD'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, J3GmXcsVgB8xj2jgOy1.cs High entropy of concatenated method names: 'aAXWq8nDhs', 'zK3WVUg6Gk', 'R9UWkiyXhJ', 'p0BW9uM3mh', 'TIIWSZYYRM', 'paIWtgFZdq', 'zueW1rCm7g', 'kq4WiEnGgH', 'TZKWWY5Hdq', 'kaQWTl6ne3'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, NeDMGK7MbPn0xXYwDsh.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, zvPoZsuLyut2friVVKx.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'eG6nLUiuxUKnV5eLyXi', 'pUJZ1PimjKH6gsvY63v', 'zjOkeJiyvbqcNnbFZqd', 'qaoBcXisKJSL2cc2ZXP', 'HPxaTGiBQLTYlkyhoMW', 'n1Z4yCiTsrZ8jEutMOd'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, lUg6IVuNPD8o5vWXyvq.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'xmpuSHDHtONu3DY7gI5', 'f0DCvDDcOrmE0YuSXqj', 'EWe5ygDVqMDrknMPwW2', 'yOd3agDuEHM5GrTE2em', 'tKfajGDmEYqYmk3Ma2t', 'kwU5f5DyNawbeRABWSo'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, y6B2sEu8BO50D0gpddW.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'OeJ3AiDlFOeTZE9sPLU', 'BYlUfIDpJ0Zx9U2UUF2', 'oCJNCsD57IThYmAHZ8e', 'sT4aVdDA811tE9PcOat', 'GlrImTDwSlwWhcTmSAR', 'QbcgfrDWrMMZvuFM5I5'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, ECGWeuJ6XU2xwjttGYt.cs High entropy of concatenated method names: 'dK9IoRH30gleVrH40CO', 'XvqFU6HKSFUCkW5DiUU', 'O3oU8MHCdNyvewbRsv3', 'oRm8v9HfUVTMRiR0akc', 'IWF', 'j72', 'F4ECxC3aYt', 'l5AC83tX1e', 'j4z', 'JADCBWNQkt'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, fCvAaGJbOISiMM9DuTO.cs High entropy of concatenated method names: 'SbeZ2IyDjp', 'fEhZrH8LWq', 'jHfZxeSfF0', 'dtU9Nw7x10FSqWluxA6', 'uvkdFt7YbRCSR9eoGHL', 'Mm0VKs7EpTpfMZaMUcr', 'wt0onG7ghd1YfXogUOf', 'eP9ZGBBYXL', 'tuqZshxXjT', 'XfbZmATHvV'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, fD5S5GaeHF8smwvouSD.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'gSVRQSJ8O5', 'syWRp5GD5S', 'RGHRhF8smw', 'aouReSDFpS', 'xoGRf9UAwJ', 'R90KP9qbBddXc9Whdf9', 'bUdNn8qXrlWpkCaf2Oj', 'CFhsfAqiL9e2aM9bRsX'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, VDWJntWWlw06vjKFE9.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'UKF4W4Ftj', 'FtRNb25niECe3TqxKBF', 'Haw5205vt4HG2oMmh1J', 'w0iwxr59JfXiCHXXckh', 'CLZh3M57j2VYIXhdV6P', 'I1tL9G5rKYZZjOR5TRd'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, QECQLMRJjJZmG5cxf27.cs High entropy of concatenated method names: 'fk9F0KtrL0YK8Pvtsle', 'r5Ub1vtL4B55HmSjDMf', 'uEc4hAt9PcIsBR4khIt', 'TnP6BLt7OF4u1rZRYj0', 'lwhOqtffOA', 'eb49OdtV1hCpJNvaFcg', 'tWEpNltuJAG6Nv5Qyo6', 'bsSIF9tHAPhHXfTeOQu', 'q47p9ctcnrhvSJ9TQHn', 'gkxuj6tmQkcP6mg0Qhy'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, k9bi73G9mowv1Yj05Z4.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, J5j6tMur4opWnoEyDT1.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'IPfpariIU4UxmBe88H8', 'dqEwYIi8LVaEAnky12k', 'minJ2TiS4ZlMrpVDkU2', 'wXqoecia0Ip93eaosPk', 'wgdo4YiJFQWgEY5AZPM', 'sNnD1Fio1uSsy6VCZWV'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, Sm7FCVRPUjdKT87y6Up.cs High entropy of concatenated method names: 'uknV7FveCA', 'WFMVRkpmJ0', 'aUYVGRi5bn', 'xb3Vsr1JtK', 'gHCVmj7fS7', 'aDqVZ9oSaf', 'OCpVCQxuwD', 'cyeVFU2RLd', 'HY4VKautly', 'CkbVLUnWBR'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, xODuXeu0FIatQXDBxY7.cs High entropy of concatenated method names: 'lvMaucu3Am', 'KSsaa4s9Pp', 'bsaaJRRIWx', 'b8RUhRXQ6kEHvPUxLiJ', 'Uu89pZXIh0GHuZkWmhO', 'vWpbI3XeBI4hJaPtsjx', 'sCCVLpXFHpsMyYmNdAo', 'pva2NcX8PT7YKYP75ZS', 'DlQYEpXS6QyrSOvW5Lo', 'jkEnI8XacSVkZvssR5k'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, em50CEGU2PgNRVJruTE.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'Rsu1Z4V8dD', 'ySG1CWKfXh', 'oyy1FYZ7Mj', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, yHjnyrXIDUbermwuYI.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'GkuI6GEEd', 'w2qLZ15C7K5xAnc22GK', 'x6A02O5fZPRkUKNElhA', 'zP0qF353HX0BQX1a2ZT', 'nIAs3X5KE8vC8bmPN2N', 'sAwNRe5RWAXEkv4EEDJ'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, gHURQlJ7aCCH0lBIKXn.cs High entropy of concatenated method names: 'nfEsAgtGXi', 'O8VsI83LSF', 'tU5sUYGORO', 'bTus3tMYam', 'FrWsDX94ms', 'qpQsHcgXTb', 'B5S3o0nydvo8835xMDr', 'WwnjMknuNE4YeHRhIFH', 'uUWvTMnm8C8e5MaXcKM', 'nvTQqFnsD6DC7Ij5wQM'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, ofJ1RPRQqGuLNDpEiI3.cs High entropy of concatenated method names: 'XxmVvywmnm', 'Clx0IZ3J20QWK2TgKdZ', 'H5t7813SjErX15N3BCY', 'lY2kt63aVtGL6TKNlIa', 'pCs1d73oGGfUoVyNcXu', 'ro7Dii3dInbH4Ko8600', 'ovX94v3zY7rCg38iqWq'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, COd7l9Jrce6yBgJOwFE.cs High entropy of concatenated method names: 'EZLmg3AHwt', 'cbOm5I1qGr', 'jjAmoNcjaT', 'ktLL0C94c4msr6h72ft', 'z4eXEH9ZmwnZhPAixp0', 'qk2ETj9NSc0XqnnpEJF', 'VHfUke9eKIAGNuhqDd1', 'Fcn73O9FBdkrVZbKNQ3', 'PG9nOr9QpC3wvgrimum', 'LqCEht9IWX09cRDiIdf'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, uNFEOGuoEdjm4vpiMLI.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'UjsC4NOT4XXCBssLN93', 'sldjkEOt6Q5SUQPj0TL', 'cMJykHOGHFEw8FUJLqE', 'pc0ZJWOCGyQHIrOo05l', 'JmgRuPOfvjlwpM7FrOM', 'P7a5GqO3eo7EeRrhYiM'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, ToLjk3gvWXZNAAPPEs.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'rmAWQyW2oIrQjCaiDiE', 'qwhO4UWiFFlZq26SNtQ', 'Pm10aKWDU3pAduiLEN8', 'oAYmffWbI2eiCXcAhg5', 'J2AENtWXdqJK1dZHNd0', 'fKjKPKWOmSW5BohAFBM'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, SE9XYP6ZrMTs98IqVA.cs High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'f1U7RqWggDYThuUAEMl', 'KU8C5RW4fbspPQ5WHlb', 'caag74WZM4W1a3vcDa1', 'NEfO60WNSwMdA9VYEsY', 'lmQeoIWe10uuw4WYO2Q', 'ocOOQPWF1DpJt15M68I'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, tMovr3GV7CohDM44Ho9.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, Qaas3LcbKU1PXAy0Tg.cs High entropy of concatenated method names: 'nBSqVpFEX', 'qayV2nntS', 'Rb5kkk4OD', 'Jfu9xkHS5', 'mnQSeY7Eu', 'CLGtYK0wq', 'FIt1g6BXB', 'wooyggpDGhfhPRGFFkS', 'NDw7fPpbjMe6FThWwLD', 'PwpWRupXFG8PHehhJhe'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, hCsNyXJD5vKLl0WFlhC.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'lZ8T0s0OrX', 'TNCC7kYobG', 'RQmTC8heMW', 'YJYnkyLkR8JSRoAdO4W', 'HkH37AL6CwPcWAw6myF', 'if3eydL1Qd3QF2BGkBU', 'LQZlNqLj1TyrmWpJQQT', 'KotKdILMgTkTvcnLxuP'
Source: 1.3.Result.exe.2642c39.0.raw.unpack, p4VMiu79MPUyk8DkE6i.cs High entropy of concatenated method names: 'JeMyXos1Mo', 'SdLyQPn7LQ', 'ybcyplpcur', 'xg3yh4a4jx', 'jBAyelkSal', 'p1oRIsunLidrkxQK4lU', 'tqgvr8uqijJEd8w7OMC', 'BhuM0PuU0kdmyxuA67K', 'HPuWJ2uvKlQgjmZ1RIm', 'ixw6K5u9fUIJHcUSbCg'

Persistence and Installation Behavior
barindex
Creates processes via WMI
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Drops PE files
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\IdentityCRL\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe File created: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File created: C:\Users\user\AppData\Roaming\XClient.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\IME\IMEKR\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\sihost.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\ELAMBKUP\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Program Files\Uninstall Information\OfficeClickToRun.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Recovery\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Program Files\Windows Photo Viewer\en-GB\UserOOBEBroker.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe File created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Jump to dropped file
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Recovery\XClient.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\RuntimeBroker.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Program Files (x86)\jDownloader\config\conhost.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Program Files\Windows Multimedia Platform\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe File created: C:\Users\user\AppData\Local\Temp\XClient.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Program Files\Windows Photo Viewer\en-GB\RuntimeBroker.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\IdentityCRL\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\IME\IMEKR\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File created: C:\Windows\ELAMBKUP\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Jump to dropped file

Boot Survival
barindex
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Creates an undocumented autostart registry key
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UserOOBEBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /f
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UserOOBEBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UserOOBEBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UserOOBEBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UserOOBEBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run FMxFFfLOKpqCLtTFEmbkPKJrDwH
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Memory allocated: CC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Memory allocated: 1A6A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Memory allocated: F70000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Memory allocated: 1A900000 memory reserve | memory write watch
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Memory allocated: 2C90000 memory reserve | memory write watch
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Memory allocated: 1AEC0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Memory allocated: AC0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Memory allocated: 1A6A0000 memory reserve | memory write watch
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Memory allocated: A00000 memory reserve | memory write watch
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Memory allocated: 1A8C0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Window / User API: threadDelayed 2919 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Window / User API: threadDelayed 6843 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Window / User API: threadDelayed 1134
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Window / User API: threadDelayed 1242
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Window / User API: threadDelayed 368
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Window / User API: threadDelayed 365
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Window / User API: threadDelayed 362
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\XClient.exe TID: 8528 Thread sleep time: -19369081277395017s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe TID: 8532 Thread sleep count: 2919 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe TID: 8532 Thread sleep count: 6843 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe TID: 7536 Thread sleep count: 1134 > 30
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe TID: 7540 Thread sleep count: 1242 > 30
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe TID: 7560 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe TID: 7608 Thread sleep count: 368 > 30
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe TID: 4476 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe TID: 8180 Thread sleep count: 365 > 30
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe TID: 7420 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe TID: 7416 Thread sleep count: 362 > 30
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe TID: 7988 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C018647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7C018647C
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C019ECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7C019ECE0
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01B3130 FindFirstFileExA, 0_2_00007FF7C01B3130
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008DA5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 2_2_008DA5F4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008EB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 2_2_008EB8E0
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01A5134 VirtualQuery,GetSystemInfo, 0_2_00007FF7C01A5134
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Thread delayed: delay time: 922337203685477
Source: DCRatBuild.exe, 00000002.00000003.1710608400.0000000002B01000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: DCRatBuild.exe, 00000002.00000003.1713100279.0000000002B01000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yL
Source: ServerWeb.exe, 00000008.00000002.2233912155.000000001C81F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Result.exe, 00000001.00000002.1703441913.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: XClient.exe, 00000003.00000002.4194286088.000000001B690000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWwIns%SystemRoot%\system32\mswsock.dlltivityStateQuery activityName="*">
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process information queried: ProcessInformation
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01A6940 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF7C01A6940
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008F753D mov eax, dword ptr fs:[00000030h] 2_2_008F753D
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01B41B0 GetProcessHeap, 0_2_00007FF7C01B41B0
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Process token adjusted: Debug
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01A6940 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF7C01A6940
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01A6B24 SetUnhandledExceptionFilter, 0_2_00007FF7C01A6B24
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01AAC68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF7C01AAC68
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01A5CE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF7C01A5CE0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008EF063 SetUnhandledExceptionFilter, 2_2_008EF063
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008EF22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_008EF22B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008F866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_008F866F
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: 2_2_008EEF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_008EEF05
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Memory allocated: page read and write | page guard Jump to behavior
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C019ECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7C019ECE0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe Process created: C:\Users\user\AppData\Local\Temp\XClient.exe "C:\Users\user\AppData\Local\Temp\XClient.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\UGsUclNNu9UBh.vbe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\file.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\hUqNkgIMv7nY24UYezK0etl.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe "C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "FMxFFfLOKpqCLtTFEmbkPKJrDwHF" /sc MINUTE /mo 8 /tr "'C:\Recovery\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe'" /rl HIGHEST /f
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C018DBDC cpuid 0_2_00007FF7C018DBDC
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: GetLocaleInfoW,GetNumberFormatW, 0_2_00007FF7C019DE44
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe Code function: GetLocaleInfoW,GetNumberFormatW, 2_2_008EA63C
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\XClient.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Queries volume information: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Queries volume information: C:\Program Files (x86)\jDownloader\config\conhost.exe VolumeInformation
Source: C:\Program Files (x86)\jDownloader\config\conhost.exe Queries volume information: C:\Program Files (x86)\jDownloader\config\conhost.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Templates\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe VolumeInformation
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C01A400C GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7C01A400C
Source: C:\Users\user\Desktop\ywXeiXEvP2.exe Code function: 0_2_00007FF7C0186768 GetVersionExW, 0_2_00007FF7C0186768
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable UAC(promptonsecuredesktop)
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created: PromptOnSecureDesktop 0
Disables UAC (registry)
Source: C:\Users\user\AppData\Roaming\Hypercontainercomponentnetcommon\ServerWeb.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA
AV process strings found (often used to terminate AV products)
Source: XClient.exe, 00000003.00000002.4155365471.0000000000872000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000003.00000002.4155365471.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000003.00000002.4194286088.000000001B690000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000003.00000002.4194286088.000000001B702000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\XClient.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected DCRat
Source: Yara match File source: 00000029.00000002.1997852879.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1889481824.0000000002F1A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1889481824.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1976381139.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1958522017.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.1997852879.00000000028DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1902459797.000000001290D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ServerWeb.exe PID: 7488, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: conhost.exe PID: 7280, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: conhost.exe PID: 2008, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe PID: 7368, type: MEMORYSTR
Yara detected XWorm
Source: Yara match File source: Result.exe, type: SAMPLE
Source: Yara match File source: 1.3.Result.exe.b10a30.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.Result.exe.7c9678.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.XClient.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.Result.exe.7c9678.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.Result.exe.b10a30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Result.exe.b08218.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.Result.exe.466afd.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.Result.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.Result.exe.415eec.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000003.1702782236.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.1702689242.0000000000482000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1703441913.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1719076090.00007FF7C01D6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.1684955911.0000000000408000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ywXeiXEvP2.exe PID: 6852, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Result.exe PID: 4900, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: XClient.exe PID: 7204, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected DCRat
Source: Yara match File source: 00000029.00000002.1997852879.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1889481824.0000000002F1A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1889481824.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1976381139.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1958522017.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.1997852879.00000000028DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1902459797.000000001290D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ServerWeb.exe PID: 7488, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: conhost.exe PID: 7280, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: conhost.exe PID: 2008, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe PID: 7368, type: MEMORYSTR
Yara detected XWorm
Source: Yara match File source: Result.exe, type: SAMPLE
Source: Yara match File source: 1.3.Result.exe.b10a30.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.Result.exe.7c9678.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.XClient.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.Result.exe.7c9678.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.Result.exe.b10a30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Result.exe.b08218.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.Result.exe.466afd.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.Result.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.Result.exe.415eec.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000003.1702782236.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.1702689242.0000000000482000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1703441913.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1719076090.00007FF7C01D6000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.1684955911.0000000000408000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ywXeiXEvP2.exe PID: 6852, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Result.exe PID: 4900, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: XClient.exe PID: 7204, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\RarSFX0\Result.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1455415 Sample: ywXeiXEvP2.exe Startdate: 11/06/2024 Architecture: WINDOWS Score: 100 74 letter-takes.gl.at.ply.gg 2->74 82 Snort IDS alert for network traffic 2->82 84 Found malware configuration 2->84 86 Malicious sample detected (through community Yara rule) 2->86 88 16 other signatures 2->88 12 ywXeiXEvP2.exe 10 2->12         started        15 FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe 2->15         started        18 conhost.exe 2->18         started        20 conhost.exe 2->20         started        signatures3 process4 file5 72 C:\Users\user\AppData\Local\...\Result.exe, PE32 12->72 dropped 22 Result.exe 3 12->22         started        112 Multi AV Scanner detection for dropped file 15->112 signatures6 process7 file8 54 C:\Users\user\AppData\Local\...\XClient.exe, PE32 22->54 dropped 56 C:\Users\user\AppData\...\DCRatBuild.exe, PE32 22->56 dropped 90 Antivirus detection for dropped file 22->90 92 Multi AV Scanner detection for dropped file 22->92 94 Machine Learning detection for dropped file 22->94 26 DCRatBuild.exe 3 11 22->26         started        30 XClient.exe 5 22->30         started        signatures9 process10 dnsIp11 66 C:\Users\user\AppData\...\ServerWeb.exe, PE32 26->66 dropped 68 C:\Users\user\AppData\...\UGsUclNNu9UBh.vbe, data 26->68 dropped 104 Antivirus detection for dropped file 26->104 106 Multi AV Scanner detection for dropped file 26->106 108 Machine Learning detection for dropped file 26->108 33 wscript.exe 1 26->33         started        36 wscript.exe 26->36         started        76 letter-takes.gl.at.ply.gg 147.185.221.19, 50230, 53164, 53165 SALSGIVERUS United States 30->76 78 127.0.0.1 unknown unknown 30->78 70 C:\Users\user\AppData\Roaming\XClient.exe, PE32 30->70 dropped 110 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 30->110 file12 signatures13 process14 signatures15 80 Windows Scripting host queries suspicious COM object (likely to drop second stage) 33->80 38 cmd.exe 33->38         started        process16 process17 40 ServerWeb.exe 38->40         started        44 conhost.exe 38->44         started        file18 58 C:\...\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe, PE32 40->58 dropped 60 C:\...\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe, PE32 40->60 dropped 62 C:\...\FMxFFfLOKpqCLtTFEmbkPKJrDwH.exe, PE32 40->62 dropped 64 11 other malicious files 40->64 dropped 96 Antivirus detection for dropped file 40->96 98 Multi AV Scanner detection for dropped file 40->98 100 Creates an undocumented autostart registry key 40->100 102 7 other signatures 40->102 46 schtasks.exe 40->46         started        48 schtasks.exe 40->48         started        50 schtasks.exe 40->50         started        52 23 other processes 40->52 signatures19 process20
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
147.185.221.19
 letter-takes.gl.at.ply.gg United States
12087 SALSGIVERUS true

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
letter-takes.gl.at.ply.gg 147.185.221.19 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
letter-takes.gl.at.ply.gg true
  • Avira URL Cloud: safe
 unknown
http://a0991799.xsph.ru/@=AjM2MDZ4kjN true
  • Avira URL Cloud: malware
 unknown
127.0.0.1 true
  • Avira URL Cloud: safe
 unknown